From 7d0920bbfa244c20c05ac94f9f9fb6ac1c19867b Mon Sep 17 00:00:00 2001
From: Larry Gregory <larry.gregory@elastic.co>
Date: Fri, 2 Apr 2021 23:26:35 -0400
Subject: [PATCH 01/17] Replace lodash templates with static react renderer for
 field formatters (#96048)

---
 .../field_formats/converters/color.test.ts    | 14 ++---
 .../converters/{color.ts => color.tsx}        | 23 +++++---
 .../field_formats/converters/source.test.ts   | 16 ++++++
 .../converters/{source.ts => source.tsx}      | 52 +++++++++----------
 4 files changed, 62 insertions(+), 43 deletions(-)
 rename src/plugins/data/common/field_formats/converters/{color.ts => color.tsx} (79%)
 rename src/plugins/data/common/field_formats/converters/{source.ts => source.tsx} (62%)

diff --git a/src/plugins/data/common/field_formats/converters/color.test.ts b/src/plugins/data/common/field_formats/converters/color.test.ts
index 9ce00db10b28d..4b7f2733f56fc 100644
--- a/src/plugins/data/common/field_formats/converters/color.test.ts
+++ b/src/plugins/data/common/field_formats/converters/color.test.ts
@@ -28,10 +28,10 @@ describe('Color Format', () => {
 
       expect(colorer.convert(99, HTML_CONTEXT_TYPE)).toBe('<span ng-non-bindable>99</span>');
       expect(colorer.convert(100, HTML_CONTEXT_TYPE)).toBe(
-        '<span ng-non-bindable><span style="color: blue;background-color: yellow;">100</span></span>'
+        '<span ng-non-bindable><span style="color:blue;background-color:yellow">100</span></span>'
       );
       expect(colorer.convert(150, HTML_CONTEXT_TYPE)).toBe(
-        '<span ng-non-bindable><span style="color: blue;background-color: yellow;">150</span></span>'
+        '<span ng-non-bindable><span style="color:blue;background-color:yellow">150</span></span>'
       );
       expect(colorer.convert(151, HTML_CONTEXT_TYPE)).toBe('<span ng-non-bindable>151</span>');
     });
@@ -74,22 +74,22 @@ describe('Color Format', () => {
 
       expect(converter('B', HTML_CONTEXT_TYPE)).toBe('<span ng-non-bindable>B</span>');
       expect(converter('AAA', HTML_CONTEXT_TYPE)).toBe(
-        '<span ng-non-bindable><span style="color: blue;background-color: yellow;">AAA</span></span>'
+        '<span ng-non-bindable><span style="color:blue;background-color:yellow">AAA</span></span>'
       );
       expect(converter('AB', HTML_CONTEXT_TYPE)).toBe(
-        '<span ng-non-bindable><span style="color: blue;background-color: yellow;">AB</span></span>'
+        '<span ng-non-bindable><span style="color:blue;background-color:yellow">AB</span></span>'
       );
       expect(converter('a', HTML_CONTEXT_TYPE)).toBe('<span ng-non-bindable>a</span>');
 
       expect(converter('B', HTML_CONTEXT_TYPE)).toBe('<span ng-non-bindable>B</span>');
       expect(converter('AAA', HTML_CONTEXT_TYPE)).toBe(
-        '<span ng-non-bindable><span style="color: blue;background-color: yellow;">AAA</span></span>'
+        '<span ng-non-bindable><span style="color:blue;background-color:yellow">AAA</span></span>'
       );
       expect(converter('AB', HTML_CONTEXT_TYPE)).toBe(
-        '<span ng-non-bindable><span style="color: blue;background-color: yellow;">AB</span></span>'
+        '<span ng-non-bindable><span style="color:blue;background-color:yellow">AB</span></span>'
       );
       expect(converter('AB <', HTML_CONTEXT_TYPE)).toBe(
-        '<span ng-non-bindable><span style="color: blue;background-color: yellow;">AB &lt;</span></span>'
+        '<span ng-non-bindable><span style="color:blue;background-color:yellow">AB &lt;</span></span>'
       );
       expect(converter('a', HTML_CONTEXT_TYPE)).toBe('<span ng-non-bindable>a</span>');
     });
diff --git a/src/plugins/data/common/field_formats/converters/color.ts b/src/plugins/data/common/field_formats/converters/color.tsx
similarity index 79%
rename from src/plugins/data/common/field_formats/converters/color.ts
rename to src/plugins/data/common/field_formats/converters/color.tsx
index f4603f32acc15..98f25fdf81811 100644
--- a/src/plugins/data/common/field_formats/converters/color.ts
+++ b/src/plugins/data/common/field_formats/converters/color.tsx
@@ -7,15 +7,15 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { findLast, cloneDeep, template, escape } from 'lodash';
+import React from 'react';
+import ReactDOM from 'react-dom/server';
+import { findLast, cloneDeep, escape } from 'lodash';
 import { KBN_FIELD_TYPES } from '../../kbn_field_types/types';
 import { FieldFormat } from '../field_format';
 import { HtmlContextTypeConvert, FIELD_FORMAT_IDS } from '../types';
 import { asPrettyString } from '../utils';
 import { DEFAULT_CONVERTER_COLOR } from '../constants/color_default';
 
-const convertTemplate = template('<span style="<%- style %>"><%- val %></span>');
-
 export class ColorFormat extends FieldFormat {
   static id = FIELD_FORMAT_IDS.COLOR;
   static title = i18n.translate('data.fieldFormats.color.title', {
@@ -51,11 +51,18 @@ export class ColorFormat extends FieldFormat {
 
   htmlConvert: HtmlContextTypeConvert = (val) => {
     const color = this.findColorRuleForVal(val) as typeof DEFAULT_CONVERTER_COLOR;
-    if (!color) return escape(asPrettyString(val));
 
-    let style = '';
-    if (color.text) style += `color: ${color.text};`;
-    if (color.background) style += `background-color: ${color.background};`;
-    return convertTemplate({ val, style });
+    const displayVal = escape(asPrettyString(val));
+    if (!color) return displayVal;
+
+    return ReactDOM.renderToStaticMarkup(
+      <span
+        style={{
+          color: color.text,
+          backgroundColor: color.background,
+        }}
+        dangerouslySetInnerHTML={{ __html: displayVal }} // eslint-disable-line react/no-danger
+      />
+    );
   };
 }
diff --git a/src/plugins/data/common/field_formats/converters/source.test.ts b/src/plugins/data/common/field_formats/converters/source.test.ts
index f0576142892e2..655cf315a05a4 100644
--- a/src/plugins/data/common/field_formats/converters/source.test.ts
+++ b/src/plugins/data/common/field_formats/converters/source.test.ts
@@ -9,6 +9,7 @@
 import { SourceFormat } from './source';
 import { HtmlContextTypeConvert } from '../types';
 import { HTML_CONTEXT_TYPE } from '../content_types';
+import { stubIndexPatternWithFields } from '../../index_patterns/index_pattern.stub';
 
 describe('Source Format', () => {
   let convertHtml: Function;
@@ -31,4 +32,19 @@ describe('Source Format', () => {
       '<span ng-non-bindable>{&quot;foo&quot;:&quot;bar&quot;,&quot;number&quot;:42,&quot;hello&quot;:&quot;&lt;h1&gt;World&lt;/h1&gt;&quot;,&quot;also&quot;:&quot;with \\&quot;quotes\\&quot; or &#39;single quotes&#39;&quot;}</span>'
     );
   });
+
+  test('should render a description list if a field is passed', () => {
+    const hit = {
+      foo: 'bar',
+      number: 42,
+      hello: '<h1>World</h1>',
+      also: 'with "quotes" or \'single quotes\'',
+    };
+
+    const indexPattern = { ...stubIndexPatternWithFields, formatHit: (h: string) => h };
+
+    expect(convertHtml(hit, { field: 'field', indexPattern, hit })).toMatchInlineSnapshot(
+      `"<span ng-non-bindable><dl class=\\"source truncate-by-height\\"><dt>foo:</dt><dd>bar</dd> <dt>number:</dt><dd>42</dd> <dt>hello:</dt><dd><h1>World</h1></dd> <dt>also:</dt><dd>with \\"quotes\\" or 'single quotes'</dd> </dl></span>"`
+    );
+  });
 });
diff --git a/src/plugins/data/common/field_formats/converters/source.ts b/src/plugins/data/common/field_formats/converters/source.tsx
similarity index 62%
rename from src/plugins/data/common/field_formats/converters/source.ts
rename to src/plugins/data/common/field_formats/converters/source.tsx
index bacfc1ab4c737..d6176b321f3f3 100644
--- a/src/plugins/data/common/field_formats/converters/source.ts
+++ b/src/plugins/data/common/field_formats/converters/source.tsx
@@ -6,40 +6,34 @@
  * Side Public License, v 1.
  */
 
-import { template, escape, keys } from 'lodash';
+import React, { Fragment } from 'react';
+import ReactDOM from 'react-dom/server';
+import { escape, keys } from 'lodash';
 import { shortenDottedString } from '../../utils';
 import { KBN_FIELD_TYPES } from '../../kbn_field_types/types';
 import { FieldFormat } from '../field_format';
 import { TextContextTypeConvert, HtmlContextTypeConvert, FIELD_FORMAT_IDS } from '../types';
 import { UI_SETTINGS } from '../../constants';
 
-/**
- * Remove all of the whitespace between html tags
- * so that inline elements don't have extra spaces.
- *
- * If you have inline elements (span, a, em, etc.) and any
- * amount of whitespace around them in your markup, then the
- * browser will push them apart. This is ugly in certain
- * scenarios and is only fixed by removing the whitespace
- * from the html in the first place (or ugly css hacks).
- *
- * @param  {string} html - the html to modify
- * @return {string} - modified html
- */
-function noWhiteSpace(html: string) {
-  const TAGS_WITH_WS = />\s+</g;
-  return html.replace(TAGS_WITH_WS, '><');
+interface Props {
+  defPairs: Array<[string, string]>;
 }
-
-const templateHtml = `
-  <dl class="source truncate-by-height">
-    <% defPairs.forEach(function (def) { %>
-      <dt><%- def[0] %>:</dt>
-      <dd><%= def[1] %></dd>
-      <%= ' ' %>
-    <% }); %>
-  </dl>`;
-const doTemplate = template(noWhiteSpace(templateHtml));
+const TemplateComponent = ({ defPairs }: Props) => {
+  return (
+    <dl className={'source truncate-by-height'}>
+      {defPairs.map((pair, idx) => (
+        <Fragment key={idx}>
+          <dt
+            dangerouslySetInnerHTML={{ __html: `${escape(pair[0])}:` }} // eslint-disable-line react/no-danger
+          />
+          <dd
+            dangerouslySetInnerHTML={{ __html: `${pair[1]}` }} // eslint-disable-line react/no-danger
+          />{' '}
+        </Fragment>
+      ))}
+    </dl>
+  );
+};
 
 export class SourceFormat extends FieldFormat {
   static id = FIELD_FORMAT_IDS._SOURCE;
@@ -70,6 +64,8 @@ export class SourceFormat extends FieldFormat {
       pairs.push([newField, val]);
     }, []);
 
-    return doTemplate({ defPairs: highlightPairs.concat(sourcePairs) });
+    return ReactDOM.renderToStaticMarkup(
+      <TemplateComponent defPairs={highlightPairs.concat(sourcePairs)} />
+    );
   };
 }

From f8a6ba223ac5d44c627458176859050ab3f4d200 Mon Sep 17 00:00:00 2001
From: Spencer <email@spalger.com>
Date: Sun, 4 Apr 2021 09:15:14 -0700
Subject: [PATCH 02/17] stop wrapping steps in runbld (#96195)

Co-authored-by: spalger <spalger@users.noreply.github.com>
---
 vars/runbld.groovy | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/vars/runbld.groovy b/vars/runbld.groovy
index e52bc244c65cb..1a8ebec18d485 100644
--- a/vars/runbld.groovy
+++ b/vars/runbld.groovy
@@ -1,8 +1,8 @@
 def call(script, label, enableJunitProcessing = false) {
-  def extraConfig = enableJunitProcessing ? "" : "--config ${env.WORKSPACE}/kibana/.ci/runbld_no_junit.yml"
+  // def extraConfig = enableJunitProcessing ? "" : "--config ${env.WORKSPACE}/kibana/.ci/runbld_no_junit.yml"
 
   sh(
-    script: "/usr/local/bin/runbld -d '${pwd()}' ${extraConfig} ${script}",
+    script: script,
     label: label ?: script
   )
 }

From 763c0038ae965ce8633b8c247999469b321e3371 Mon Sep 17 00:00:00 2001
From: spalger <spalger@users.noreply.github.com>
Date: Sun, 4 Apr 2021 09:34:58 -0700
Subject: [PATCH 03/17] Revert "stop wrapping steps in runbld (#96195)"

This reverts commit f8a6ba223ac5d44c627458176859050ab3f4d200.
---
 vars/runbld.groovy | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/vars/runbld.groovy b/vars/runbld.groovy
index 1a8ebec18d485..e52bc244c65cb 100644
--- a/vars/runbld.groovy
+++ b/vars/runbld.groovy
@@ -1,8 +1,8 @@
 def call(script, label, enableJunitProcessing = false) {
-  // def extraConfig = enableJunitProcessing ? "" : "--config ${env.WORKSPACE}/kibana/.ci/runbld_no_junit.yml"
+  def extraConfig = enableJunitProcessing ? "" : "--config ${env.WORKSPACE}/kibana/.ci/runbld_no_junit.yml"
 
   sh(
-    script: script,
+    script: "/usr/local/bin/runbld -d '${pwd()}' ${extraConfig} ${script}",
     label: label ?: script
   )
 }

From cf22394807f0112dbe415acfdfdc75e3dc636e2e Mon Sep 17 00:00:00 2001
From: Spencer <email@spalger.com>
Date: Sun, 4 Apr 2021 11:40:42 -0700
Subject: [PATCH 04/17] pass script to bash to support scripts which aren't
 actually executable (#96198)

Co-authored-by: spalger <spalger@users.noreply.github.com>
---
 vars/runbld.groovy | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/vars/runbld.groovy b/vars/runbld.groovy
index e52bc244c65cb..80416d4fa9a41 100644
--- a/vars/runbld.groovy
+++ b/vars/runbld.groovy
@@ -1,8 +1,8 @@
 def call(script, label, enableJunitProcessing = false) {
-  def extraConfig = enableJunitProcessing ? "" : "--config ${env.WORKSPACE}/kibana/.ci/runbld_no_junit.yml"
+  // def extraConfig = enableJunitProcessing ? "" : "--config ${env.WORKSPACE}/kibana/.ci/runbld_no_junit.yml"
 
   sh(
-    script: "/usr/local/bin/runbld -d '${pwd()}' ${extraConfig} ${script}",
+    script: "bash ${script}",
     label: label ?: script
   )
 }

From 8c8323abfd5863825a001081ed090581b223d5b7 Mon Sep 17 00:00:00 2001
From: Anton Dosov <anton.dosov@elastic.co>
Date: Mon, 5 Apr 2021 14:01:24 +0200
Subject: [PATCH 05/17] [Search Sessions] fix updating deleting sessions from
 non-default space (#96123)

* add spaces test

* fix updating and deleting sessions in non-default space

* revert back to batch update

* Add space tests

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Liza K <liza.katz@elastic.co>
---
 .../session/check_running_sessions.test.ts    |  90 ++++++++++-
 .../search/session/check_running_sessions.ts  |  43 ++++-
 .../api_integration/apis/search/session.ts    | 153 ++++++++++++++++++
 3 files changed, 278 insertions(+), 8 deletions(-)

diff --git a/x-pack/plugins/data_enhanced/server/search/session/check_running_sessions.test.ts b/x-pack/plugins/data_enhanced/server/search/session/check_running_sessions.test.ts
index f9c62069154b6..2611f6c9da19f 100644
--- a/x-pack/plugins/data_enhanced/server/search/session/check_running_sessions.test.ts
+++ b/x-pack/plugins/data_enhanced/server/search/session/check_running_sessions.test.ts
@@ -13,9 +13,13 @@ import {
   EQL_SEARCH_STRATEGY,
 } from '../../../common';
 import { savedObjectsClientMock } from '../../../../../../src/core/server/mocks';
-import type { SavedObjectsClientContract } from 'kibana/server';
 import { SearchSessionsConfig, SearchStatus } from './types';
 import moment from 'moment';
+import {
+  SavedObjectsBulkUpdateObject,
+  SavedObjectsDeleteOptions,
+  SavedObjectsClientContract,
+} from '../../../../../../src/core/server';
 
 describe('getSearchStatus', () => {
   let mockClient: any;
@@ -263,6 +267,45 @@ describe('getSearchStatus', () => {
       expect(savedObjectsClient.delete).not.toBeCalled();
     });
 
+    test('deletes in space', async () => {
+      savedObjectsClient.find.mockResolvedValue({
+        saved_objects: [
+          {
+            id: '123',
+            namespaces: ['awesome'],
+            attributes: {
+              persisted: false,
+              status: SearchSessionStatus.IN_PROGRESS,
+              created: moment().subtract(moment.duration(3, 'm')),
+              touched: moment().subtract(moment.duration(2, 'm')),
+              idMapping: {
+                'map-key': {
+                  strategy: ENHANCED_ES_SEARCH_STRATEGY,
+                  id: 'async-id',
+                },
+              },
+            },
+          },
+        ],
+        total: 1,
+      } as any);
+
+      await checkRunningSessions(
+        {
+          savedObjectsClient,
+          client: mockClient,
+          logger: mockLogger,
+        },
+        config
+      );
+
+      expect(savedObjectsClient.delete).toBeCalled();
+
+      const [, id, opts] = savedObjectsClient.delete.mock.calls[0];
+      expect(id).toBe('123');
+      expect((opts as SavedObjectsDeleteOptions).namespace).toBe('awesome');
+    });
+
     test('deletes a non persisted, abandoned session', async () => {
       savedObjectsClient.find.mockResolvedValue({
         saved_objects: [
@@ -479,6 +522,50 @@ describe('getSearchStatus', () => {
       expect(savedObjectsClient.delete).not.toBeCalled();
     });
 
+    test('updates in space', async () => {
+      savedObjectsClient.bulkUpdate = jest.fn();
+      const so = {
+        namespaces: ['awesome'],
+        attributes: {
+          status: SearchSessionStatus.IN_PROGRESS,
+          touched: '123',
+          idMapping: {
+            'search-hash': {
+              id: 'search-id',
+              strategy: 'cool',
+              status: SearchStatus.IN_PROGRESS,
+            },
+          },
+        },
+      };
+      savedObjectsClient.find.mockResolvedValue({
+        saved_objects: [so],
+        total: 1,
+      } as any);
+
+      mockClient.asyncSearch.status.mockResolvedValue({
+        body: {
+          is_partial: false,
+          is_running: false,
+          completion_status: 200,
+        },
+      });
+
+      await checkRunningSessions(
+        {
+          savedObjectsClient,
+          client: mockClient,
+          logger: mockLogger,
+        },
+        config
+      );
+
+      expect(mockClient.asyncSearch.status).toBeCalledWith({ id: 'search-id' });
+      const [updateInput] = savedObjectsClient.bulkUpdate.mock.calls[0];
+      const updatedAttributes = updateInput[0] as SavedObjectsBulkUpdateObject;
+      expect(updatedAttributes.namespace).toBe('awesome');
+    });
+
     test('updates to complete if the search is done', async () => {
       savedObjectsClient.bulkUpdate = jest.fn();
       const so = {
@@ -563,7 +650,6 @@ describe('getSearchStatus', () => {
         config
       );
       const [updateInput] = savedObjectsClient.bulkUpdate.mock.calls[0];
-
       const updatedAttributes = updateInput[0].attributes as SearchSessionSavedObjectAttributes;
       expect(updatedAttributes.status).toBe(SearchSessionStatus.ERROR);
       expect(updatedAttributes.idMapping['search-hash'].status).toBe(SearchStatus.ERROR);
diff --git a/x-pack/plugins/data_enhanced/server/search/session/check_running_sessions.ts b/x-pack/plugins/data_enhanced/server/search/session/check_running_sessions.ts
index e521c39d7cfd3..6e52b17f36803 100644
--- a/x-pack/plugins/data_enhanced/server/search/session/check_running_sessions.ts
+++ b/x-pack/plugins/data_enhanced/server/search/session/check_running_sessions.ts
@@ -10,6 +10,7 @@ import {
   Logger,
   SavedObjectsClientContract,
   SavedObjectsFindResult,
+  SavedObjectsUpdateResponse,
 } from 'kibana/server';
 import moment from 'moment';
 import { EMPTY, from } from 'rxjs';
@@ -169,12 +170,20 @@ export async function checkRunningSessions(
 
               if (!session.attributes.persisted) {
                 if (isSessionStale(session, config, logger)) {
-                  deleted = true;
                   // delete saved object to free up memory
                   // TODO: there's a potential rare edge case of deleting an object and then receiving a new trackId for that same session!
                   // Maybe we want to change state to deleted and cleanup later?
                   logger.debug(`Deleting stale session | ${session.id}`);
-                  await savedObjectsClient.delete(SEARCH_SESSION_TYPE, session.id);
+                  try {
+                    await savedObjectsClient.delete(SEARCH_SESSION_TYPE, session.id, {
+                      namespace: session.namespaces?.[0],
+                    });
+                    deleted = true;
+                  } catch (e) {
+                    logger.error(
+                      `Error while deleting stale search session ${session.id}: ${e.message}`
+                    );
+                  }
 
                   // Send a delete request for each async search to ES
                   Object.keys(session.attributes.idMapping).map(async (searchKey: string) => {
@@ -183,8 +192,8 @@ export async function checkRunningSessions(
                       try {
                         await client.asyncSearch.delete({ id: searchInfo.id });
                       } catch (e) {
-                        logger.debug(
-                          `Error ignored while deleting async_search ${searchInfo.id}: ${e.message}`
+                        logger.error(
+                          `Error while deleting async_search ${searchInfo.id}: ${e.message}`
                         );
                       }
                     }
@@ -202,9 +211,31 @@ export async function checkRunningSessions(
           if (updatedSessions.length) {
             // If there's an error, we'll try again in the next iteration, so there's no need to check the output.
             const updatedResponse = await savedObjectsClient.bulkUpdate<SearchSessionSavedObjectAttributes>(
-              updatedSessions
+              updatedSessions.map((session) => ({
+                ...session,
+                namespace: session.namespaces?.[0],
+              }))
+            );
+
+            const success: Array<
+              SavedObjectsUpdateResponse<SearchSessionSavedObjectAttributes>
+            > = [];
+            const fail: Array<SavedObjectsUpdateResponse<SearchSessionSavedObjectAttributes>> = [];
+
+            updatedResponse.saved_objects.forEach((savedObjectResponse) => {
+              if ('error' in savedObjectResponse) {
+                fail.push(savedObjectResponse);
+                logger.error(
+                  `Error while updating search session ${savedObjectResponse?.id}: ${savedObjectResponse.error?.message}`
+                );
+              } else {
+                success.push(savedObjectResponse);
+              }
+            });
+
+            logger.debug(
+              `Updating search sessions: success: ${success.length}, fail: ${fail.length}`
             );
-            logger.debug(`Updated ${updatedResponse.saved_objects.length} search sessions`);
           }
         })
       )
diff --git a/x-pack/test/api_integration/apis/search/session.ts b/x-pack/test/api_integration/apis/search/session.ts
index 50bc85ed1e793..63a6a842fd9f7 100644
--- a/x-pack/test/api_integration/apis/search/session.ts
+++ b/x-pack/test/api_integration/apis/search/session.ts
@@ -14,6 +14,7 @@ export default function ({ getService }: FtrProviderContext) {
   const supertestWithoutAuth = getService('supertestWithoutAuth');
   const security = getService('security');
   const retry = getService('retry');
+  const spacesService = getService('spaces');
 
   describe('search session', () => {
     describe('session management', () => {
@@ -596,5 +597,157 @@ export default function ({ getService }: FtrProviderContext) {
           .expect(403);
       });
     });
+
+    describe('in non-default space', () => {
+      const spaceId = 'foo-space';
+      before(async () => {
+        try {
+          await spacesService.create({
+            id: spaceId,
+            name: 'Foo Space',
+          });
+        } catch {
+          // might already be created
+        }
+      });
+
+      after(async () => {
+        await spacesService.delete(spaceId);
+      });
+
+      it('should complete and delete non-persistent sessions', async () => {
+        const sessionId = `my-session-${Math.random()}`;
+
+        // run search
+        const searchRes = await supertest
+          .post(`/s/${spaceId}/internal/search/ese`)
+          .set('kbn-xsrf', 'foo')
+          .send({
+            sessionId,
+            params: {
+              body: {
+                query: {
+                  term: {
+                    agent: '1',
+                  },
+                },
+              },
+              wait_for_completion_timeout: '1ms',
+            },
+          })
+          .expect(200);
+
+        const { id } = searchRes.body;
+
+        await retry.waitForWithTimeout('searches persisted into session', 5000, async () => {
+          const resp = await supertest
+            .get(`/s/${spaceId}/internal/session/${sessionId}`)
+            .set('kbn-xsrf', 'foo')
+            .expect(200);
+
+          const { touched, created, persisted, idMapping } = resp.body.attributes;
+          expect(persisted).to.be(false);
+          expect(touched).not.to.be(undefined);
+          expect(created).not.to.be(undefined);
+
+          const idMappings = Object.values(idMapping).map((value: any) => value.id);
+          expect(idMappings).to.contain(id);
+          return true;
+        });
+
+        // not touched timeout in tests is 15s, wait to give a chance for status to update
+        await new Promise((resolve) =>
+          setTimeout(() => {
+            resolve(void 0);
+          }, 15_000)
+        );
+
+        await retry.waitForWithTimeout(
+          'searches eventually complete and session gets into the complete state',
+          30_000,
+          async () => {
+            await supertest
+              .get(`/s/${spaceId}/internal/session/${sessionId}`)
+              .set('kbn-xsrf', 'foo')
+              .expect(404);
+
+            return true;
+          }
+        );
+      });
+
+      it('should complete persisten session', async () => {
+        const sessionId = `my-session-${Math.random()}`;
+
+        // run search
+        const searchRes = await supertest
+          .post(`/s/${spaceId}/internal/search/ese`)
+          .set('kbn-xsrf', 'foo')
+          .send({
+            sessionId,
+            params: {
+              body: {
+                query: {
+                  term: {
+                    agent: '1',
+                  },
+                },
+              },
+              wait_for_completion_timeout: '1ms',
+            },
+          })
+          .expect(200);
+
+        const { id } = searchRes.body;
+
+        // persist session
+        await supertest
+          .post(`/s/${spaceId}/internal/session`)
+          .set('kbn-xsrf', 'foo')
+          .send({
+            sessionId,
+            name: 'My Session',
+            appId: 'discover',
+            expires: '123',
+            urlGeneratorId: 'discover',
+          })
+          .expect(200);
+
+        await retry.waitForWithTimeout('searches persisted into session', 5000, async () => {
+          const resp = await supertest
+            .get(`/s/${spaceId}/internal/session/${sessionId}`)
+            .set('kbn-xsrf', 'foo')
+            .expect(200);
+
+          const { touched, created, persisted, idMapping } = resp.body.attributes;
+          expect(persisted).to.be(true);
+          expect(touched).not.to.be(undefined);
+          expect(created).not.to.be(undefined);
+
+          const idMappings = Object.values(idMapping).map((value: any) => value.id);
+          expect(idMappings).to.contain(id);
+          return true;
+        });
+
+        // session refresh interval is 5 seconds, wait to give a chance for status to update
+        await new Promise((resolve) => setTimeout(resolve, 5000));
+
+        await retry.waitForWithTimeout(
+          'searches eventually complete and session gets into the complete state',
+          5000,
+          async () => {
+            const resp = await supertest
+              .get(`/s/${spaceId}/internal/session/${sessionId}`)
+              .set('kbn-xsrf', 'foo')
+              .expect(200);
+
+            const { status } = resp.body.attributes;
+
+            expect(status).to.be(SearchSessionStatus.COMPLETE);
+            return true;
+          }
+        );
+      });
+    });
   });
 }

From 413477b788eeaf83edf6036603c120ffb3b2f4b7 Mon Sep 17 00:00:00 2001
From: Tiago Costa <tiagoffcc@hotmail.com>
Date: Mon, 5 Apr 2021 13:36:28 +0100
Subject: [PATCH 06/17] skip flaky suite (#96113)

---
 test/functional/apps/discover/_huge_fields.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/test/functional/apps/discover/_huge_fields.ts b/test/functional/apps/discover/_huge_fields.ts
index 8cb39feb2e6bb..b3e63e482e734 100644
--- a/test/functional/apps/discover/_huge_fields.ts
+++ b/test/functional/apps/discover/_huge_fields.ts
@@ -15,7 +15,8 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const kibanaServer = getService('kibanaServer');
   const testSubjects = getService('testSubjects');
 
-  describe('test large number of fields in sidebar', function () {
+  // FLAKY: https://github.com/elastic/kibana/issues/96113
+  describe.skip('test large number of fields in sidebar', function () {
     before(async function () {
       await security.testUser.setRoles(['kibana_admin', 'test_testhuge_reader'], false);
       await esArchiver.loadIfNeeded('large_fields');

From b670ef29ae80f77d3bc2fa7dcc652d173efa985f Mon Sep 17 00:00:00 2001
From: Alexey Antonov <alexwizp@gmail.com>
Date: Mon, 5 Apr 2021 15:57:42 +0300
Subject: [PATCH 07/17] [TSVB] fix wrong field list on overriding index pattern
 for series (#96204)

---
 .../public/application/components/aggs/agg.tsx             | 6 +++---
 .../public/application/components/aggs/filter_ratio.js     | 5 +++--
 .../public/application/components/aggs/percentile.js       | 5 +++--
 .../public/application/components/aggs/positive_rate.js    | 6 +++---
 .../public/application/components/aggs/std_agg.js          | 5 +++--
 .../public/application/components/aggs/std_deviation.js    | 5 +++--
 .../public/application/components/aggs/top_hit.js          | 5 +++--
 .../public/application/components/series_config.js         | 7 +++----
 .../public/application/components/split.js                 | 5 +++--
 .../application/components/vis_types/timeseries/config.js  | 7 +++----
 10 files changed, 30 insertions(+), 26 deletions(-)

diff --git a/src/plugins/vis_type_timeseries/public/application/components/aggs/agg.tsx b/src/plugins/vis_type_timeseries/public/application/components/aggs/agg.tsx
index 25965d796e651..d02565717b247 100644
--- a/src/plugins/vis_type_timeseries/public/application/components/aggs/agg.tsx
+++ b/src/plugins/vis_type_timeseries/public/application/components/aggs/agg.tsx
@@ -48,9 +48,9 @@ export function Agg(props: AggProps) {
     ...props.style,
   };
 
-  const indexPattern =
-    (props.series.override_index_pattern && props.series.series_index_pattern) ||
-    props.panel.index_pattern;
+  const indexPattern = props.series.override_index_pattern
+    ? props.series.series_index_pattern
+    : props.panel.index_pattern;
 
   return (
     <div className={props.className} style={style}>
diff --git a/src/plugins/vis_type_timeseries/public/application/components/aggs/filter_ratio.js b/src/plugins/vis_type_timeseries/public/application/components/aggs/filter_ratio.js
index 19d2b88c8d123..7f93567980b2d 100644
--- a/src/plugins/vis_type_timeseries/public/application/components/aggs/filter_ratio.js
+++ b/src/plugins/vis_type_timeseries/public/application/components/aggs/filter_ratio.js
@@ -51,8 +51,9 @@ export const FilterRatioAgg = (props) => {
     (query) => handleChange({ denominator: query }),
     [handleChange]
   );
-  const indexPattern =
-    (series.override_index_pattern && series.series_index_pattern) || panel.index_pattern;
+  const indexPattern = series.override_index_pattern
+    ? series.series_index_pattern
+    : panel.index_pattern;
 
   const defaults = {
     numerator: getDataStart().query.queryString.getDefaultQuery(),
diff --git a/src/plugins/vis_type_timeseries/public/application/components/aggs/percentile.js b/src/plugins/vis_type_timeseries/public/application/components/aggs/percentile.js
index 505a2ff4f3c78..77b2e2f020307 100644
--- a/src/plugins/vis_type_timeseries/public/application/components/aggs/percentile.js
+++ b/src/plugins/vis_type_timeseries/public/application/components/aggs/percentile.js
@@ -39,8 +39,9 @@ export function PercentileAgg(props) {
   const handleSelectChange = createSelectHandler(handleChange);
   const handleNumberChange = createNumberHandler(handleChange);
 
-  const indexPattern =
-    (series.override_index_pattern && series.series_index_pattern) || panel.index_pattern;
+  const indexPattern = series.override_index_pattern
+    ? series.series_index_pattern
+    : panel.index_pattern;
 
   useEffect(() => {
     if (!checkModel(model)) {
diff --git a/src/plugins/vis_type_timeseries/public/application/components/aggs/positive_rate.js b/src/plugins/vis_type_timeseries/public/application/components/aggs/positive_rate.js
index a80194f72b7b2..4b1528ca27081 100644
--- a/src/plugins/vis_type_timeseries/public/application/components/aggs/positive_rate.js
+++ b/src/plugins/vis_type_timeseries/public/application/components/aggs/positive_rate.js
@@ -65,9 +65,9 @@ export const PositiveRateAgg = (props) => {
   const handleSelectChange = createSelectHandler(handleChange);
 
   const htmlId = htmlIdGenerator();
-  const indexPattern =
-    (props.series.override_index_pattern && props.series.series_index_pattern) ||
-    props.panel.index_pattern;
+  const indexPattern = props.series.override_index_pattern
+    ? props.series.series_index_pattern
+    : props.panel.index_pattern;
 
   const selectedUnitOptions = UNIT_OPTIONS.filter((o) => o.value === model.unit);
 
diff --git a/src/plugins/vis_type_timeseries/public/application/components/aggs/std_agg.js b/src/plugins/vis_type_timeseries/public/application/components/aggs/std_agg.js
index 4a4114f70f06a..74b441f446308 100644
--- a/src/plugins/vis_type_timeseries/public/application/components/aggs/std_agg.js
+++ b/src/plugins/vis_type_timeseries/public/application/components/aggs/std_agg.js
@@ -31,8 +31,9 @@ export function StandardAgg(props) {
   const handleSelectChange = createSelectHandler(handleChange);
 
   const restrictFields = getSupportedFieldsByMetricType(model.type);
-  const indexPattern =
-    (series.override_index_pattern && series.series_index_pattern) || panel.index_pattern;
+  const indexPattern = series.override_index_pattern
+    ? series.series_index_pattern
+    : panel.index_pattern;
   const htmlId = htmlIdGenerator();
 
   return (
diff --git a/src/plugins/vis_type_timeseries/public/application/components/aggs/std_deviation.js b/src/plugins/vis_type_timeseries/public/application/components/aggs/std_deviation.js
index c28cb294c3308..749a97fa79f28 100644
--- a/src/plugins/vis_type_timeseries/public/application/components/aggs/std_deviation.js
+++ b/src/plugins/vis_type_timeseries/public/application/components/aggs/std_deviation.js
@@ -72,8 +72,9 @@ const StandardDeviationAggUi = (props) => {
   const handleSelectChange = createSelectHandler(handleChange);
   const handleTextChange = createTextHandler(handleChange);
 
-  const indexPattern =
-    (series.override_index_pattern && series.series_index_pattern) || panel.index_pattern;
+  const indexPattern = series.override_index_pattern
+    ? series.series_index_pattern
+    : panel.index_pattern;
   const htmlId = htmlIdGenerator();
   const selectedModeOption = modeOptions.find((option) => {
     return model.mode === option.value;
diff --git a/src/plugins/vis_type_timeseries/public/application/components/aggs/top_hit.js b/src/plugins/vis_type_timeseries/public/application/components/aggs/top_hit.js
index 9bea32b7cbd5b..92e754c1dcdaf 100644
--- a/src/plugins/vis_type_timeseries/public/application/components/aggs/top_hit.js
+++ b/src/plugins/vis_type_timeseries/public/application/components/aggs/top_hit.js
@@ -100,8 +100,9 @@ const TopHitAggUi = (props) => {
     order: 'desc',
   };
   const model = { ...defaults, ...props.model };
-  const indexPattern =
-    (series.override_index_pattern && series.series_index_pattern) || panel.index_pattern;
+  const indexPattern = series.override_index_pattern
+    ? series.series_index_pattern
+    : panel.index_pattern;
 
   const aggWithOptionsRestrictFields = [
     PANEL_TYPES.TABLE,
diff --git a/src/plugins/vis_type_timeseries/public/application/components/series_config.js b/src/plugins/vis_type_timeseries/public/application/components/series_config.js
index 3185503acb569..8f3893feb89bd 100644
--- a/src/plugins/vis_type_timeseries/public/application/components/series_config.js
+++ b/src/plugins/vis_type_timeseries/public/application/components/series_config.js
@@ -33,10 +33,9 @@ export const SeriesConfig = (props) => {
   const handleSelectChange = createSelectHandler(props.onChange);
   const handleTextChange = createTextHandler(props.onChange);
   const htmlId = htmlIdGenerator();
-  const seriesIndexPattern =
-    props.model.override_index_pattern && props.model.series_index_pattern
-      ? props.model.series_index_pattern
-      : props.indexPatternForQuery;
+  const seriesIndexPattern = props.model.override_index_pattern
+    ? props.model.series_index_pattern
+    : props.indexPatternForQuery;
 
   return (
     <div className="tvbAggRow">
diff --git a/src/plugins/vis_type_timeseries/public/application/components/split.js b/src/plugins/vis_type_timeseries/public/application/components/split.js
index 63aa717174a04..4990800acf6db 100644
--- a/src/plugins/vis_type_timeseries/public/application/components/split.js
+++ b/src/plugins/vis_type_timeseries/public/application/components/split.js
@@ -63,8 +63,9 @@ export class Split extends Component {
 
   render() {
     const { model, panel, uiRestrictions, seriesQuantity } = this.props;
-    const indexPattern =
-      (model.override_index_pattern && model.series_index_pattern) || panel.index_pattern;
+    const indexPattern = model.override_index_pattern
+      ? model.series_index_pattern
+      : panel.index_pattern;
     const splitMode = get(this.props, 'model.split_mode', SPLIT_MODES.EVERYTHING);
     const Component = this.getComponent(splitMode, uiRestrictions);
 
diff --git a/src/plugins/vis_type_timeseries/public/application/components/vis_types/timeseries/config.js b/src/plugins/vis_type_timeseries/public/application/components/vis_types/timeseries/config.js
index 22bf2fa4ca708..1c3a0411998b0 100644
--- a/src/plugins/vis_type_timeseries/public/application/components/vis_types/timeseries/config.js
+++ b/src/plugins/vis_type_timeseries/public/application/components/vis_types/timeseries/config.js
@@ -327,10 +327,9 @@ export const TimeseriesConfig = injectI18n(function (props) {
 
   const disableSeparateYaxis = model.separate_axis ? false : true;
 
-  const seriesIndexPattern =
-    props.model.override_index_pattern && props.model.series_index_pattern
-      ? props.model.series_index_pattern
-      : props.indexPatternForQuery;
+  const seriesIndexPattern = props.model.override_index_pattern
+    ? props.model.series_index_pattern
+    : props.indexPatternForQuery;
 
   const initialPalette = {
     ...model.palette,

From 76acef0c2ceeeb38e76ac6979ee6bcbda099561c Mon Sep 17 00:00:00 2001
From: Caroline Horn <549577+cchaos@users.noreply.github.com>
Date: Mon, 5 Apr 2021 09:05:30 -0400
Subject: [PATCH 08/17] [KQL] Fixed styles of KQL textarea for the K8 theme
 (#96190)

* Fixed style of KQL textarea for K8 theme and some general heights and borders

* Fix popover paddings
---
 .../ui/filter_bar/filter_editor/index.tsx       |  2 +-
 .../public/ui/filter_bar/filter_options.tsx     |  2 +-
 .../ui/query_string_input/_query_bar.scss       | 17 +++++++++++++++--
 .../ui/query_string_input/language_switcher.tsx |  2 +-
 .../saved_query_management_component.tsx        |  4 ++--
 5 files changed, 20 insertions(+), 7 deletions(-)

diff --git a/src/plugins/data/public/ui/filter_bar/filter_editor/index.tsx b/src/plugins/data/public/ui/filter_bar/filter_editor/index.tsx
index 5639229e1ff31..d2f04228ed396 100644
--- a/src/plugins/data/public/ui/filter_bar/filter_editor/index.tsx
+++ b/src/plugins/data/public/ui/filter_bar/filter_editor/index.tsx
@@ -85,7 +85,7 @@ class FilterEditorUI extends Component<Props, State> {
   public render() {
     return (
       <div>
-        <EuiPopoverTitle>
+        <EuiPopoverTitle paddingSize="m">
           <EuiFlexGroup alignItems="baseline" responsive={false}>
             <EuiFlexItem>
               <FormattedMessage
diff --git a/src/plugins/data/public/ui/filter_bar/filter_options.tsx b/src/plugins/data/public/ui/filter_bar/filter_options.tsx
index 4065c3b8fe0df..4d80e505a55be 100644
--- a/src/plugins/data/public/ui/filter_bar/filter_options.tsx
+++ b/src/plugins/data/public/ui/filter_bar/filter_options.tsx
@@ -161,7 +161,7 @@ class FilterOptionsUI extends Component<Props, State> {
         panelPaddingSize="none"
         repositionOnScroll
       >
-        <EuiPopoverTitle>
+        <EuiPopoverTitle paddingSize="m">
           <FormattedMessage
             id="data.filter.searchBar.changeAllFiltersTitle"
             defaultMessage="Change all filters"
diff --git a/src/plugins/data/public/ui/query_string_input/_query_bar.scss b/src/plugins/data/public/ui/query_string_input/_query_bar.scss
index c758ace75bd60..466cc8c3de0b7 100644
--- a/src/plugins/data/public/ui/query_string_input/_query_bar.scss
+++ b/src/plugins/data/public/ui/query_string_input/_query_bar.scss
@@ -6,6 +6,7 @@
 // Uses the append style, but no bordering
 .kqlQueryBar__languageSwitcherButton {
   border-right: none !important;
+  border-left: $euiFormInputGroupBorder;
 }
 
 .kbnQueryBar__textareaWrap {
@@ -13,19 +14,31 @@
   display: flex;
   flex: 1 1 100%;
   position: relative;
+
+  @include kbnThemeStyle('v8') {
+    background-color: $euiFormBackgroundColor;
+  }
 }
 
 .kbnQueryBar__textarea {
   z-index: $euiZContentMenu;
   resize: none !important; // When in the group, it will autosize
-  height: $euiFormControlHeight;
+  height: $euiFormControlHeight - 2px;
   // Unlike most inputs within layout control groups, the text area still needs a border
   // for multi-line content. These adjusts help it sit above the control groups
   // shadow to line up correctly.
   padding: $euiSizeS;
-  padding-top: $euiSizeS + 3px;
   box-shadow: 0 0 0 1px $euiFormBorderColor;
 
+  @include kbnThemeStyle('v7') {
+    padding-top: $euiSizeS + 2px;
+  }
+
+  @include kbnThemeStyle('v8') {
+    border-radius: 0;
+    padding-bottom: $euiSizeS + 1px;
+  }
+
   &:not(.kbnQueryBar__textarea--autoHeight):not(:invalid) {
     @include euiYScrollWithShadows;
   }
diff --git a/src/plugins/data/public/ui/query_string_input/language_switcher.tsx b/src/plugins/data/public/ui/query_string_input/language_switcher.tsx
index 65e84612bc508..9eed22477ae4e 100644
--- a/src/plugins/data/public/ui/query_string_input/language_switcher.tsx
+++ b/src/plugins/data/public/ui/query_string_input/language_switcher.tsx
@@ -96,7 +96,7 @@ export function QueryLanguageSwitcher({
         />
       </EuiPopoverTitle>
       <div style={{ width: '350px' }}>
-        <EuiText>
+        <EuiText size="s">
           <p>
             <FormattedMessage
               id="data.query.queryBar.syntaxOptionsDescription"
diff --git a/src/plugins/data/public/ui/saved_query_management/saved_query_management_component.tsx b/src/plugins/data/public/ui/saved_query_management/saved_query_management_component.tsx
index 34e6c2c3452e6..83e7c0a9cf4fb 100644
--- a/src/plugins/data/public/ui/saved_query_management/saved_query_management_component.tsx
+++ b/src/plugins/data/public/ui/saved_query_management/saved_query_management_component.tsx
@@ -202,7 +202,7 @@ export function SavedQueryManagementComponent({
           className="kbnSavedQueryManagement__popover"
           data-test-subj="saved-query-management-popover"
         >
-          <EuiPopoverTitle id={'savedQueryManagementPopoverTitle'}>
+          <EuiPopoverTitle paddingSize="m" id={'savedQueryManagementPopoverTitle'}>
             {savedQueryPopoverTitleText}
           </EuiPopoverTitle>
           {savedQueries.length > 0 ? (
@@ -234,7 +234,7 @@ export function SavedQueryManagementComponent({
               <EuiSpacer size="s" />
             </Fragment>
           )}
-          <EuiPopoverFooter>
+          <EuiPopoverFooter paddingSize="m">
             <EuiFlexGroup
               direction="rowReverse"
               gutterSize="s"

From a640522140ae4e6806db1c6246b5587598ffaf01 Mon Sep 17 00:00:00 2001
From: Shahzad <shahzad.muhammad@elastic.co>
Date: Mon, 5 Apr 2021 15:26:48 +0200
Subject: [PATCH 09/17] [Observability] Exploratory View initial skeleton
 (#94426)

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 tsconfig.json                                 |   1 +
 x-pack/plugins/observability/kibana.json      |   2 +-
 .../public/assets/kibana_dashboard_dark.svg   | 116 ++++++
 .../public/assets/kibana_dashboard_light.svg  | 116 ++++++
 .../public/components/app/header/index.tsx    |   4 +-
 .../components/empty_view.tsx                 |  32 ++
 .../components/filter_label.test.tsx          | 138 +++++++
 .../components/filter_label.tsx               |  90 ++++
 .../configurations/constants.ts               |  73 ++++
 .../configurations/cpu_usage_config.ts        |  42 ++
 .../data/elasticsearch_fieldnames.ts          | 144 +++++++
 .../configurations/data/sample_attribute.ts   |  74 ++++
 .../data/test_index_pattern.json              |  11 +
 .../configurations/default_configs.ts         |  52 +++
 .../configurations/kpi_trends_config.ts       |  73 ++++
 .../configurations/lens_attributes.test.ts    | 387 ++++++++++++++++++
 .../configurations/lens_attributes.ts         | 273 ++++++++++++
 .../configurations/logs_frequency_config.ts   |  39 ++
 .../configurations/memory_usage_config.ts     |  42 ++
 .../configurations/monitor_duration_config.ts |  48 +++
 .../configurations/monitor_pings_config.ts    |  43 ++
 .../configurations/network_activity_config.ts |  41 ++
 .../configurations/performance_dist_config.ts |  86 ++++
 .../configurations/service_latency_config.ts  |  52 +++
 .../service_throughput_config.ts              |  55 +++
 .../configurations/url_constants.ts           |  15 +
 .../exploratory_view/configurations/utils.ts  |  54 +++
 .../exploratory_view.test.tsx                 |  93 +++++
 .../exploratory_view/exploratory_view.tsx     |  87 ++++
 .../exploratory_view/header/header.test.tsx   |  53 +++
 .../shared/exploratory_view/header/header.tsx |  63 +++
 .../hooks/use_default_index_pattern.tsx       |  61 +++
 .../hooks/use_init_exploratory_view.ts        |  44 ++
 .../hooks/use_lens_attributes.ts              |  88 ++++
 .../hooks/use_series_filters.ts               | 100 +++++
 .../hooks/use_url_strorage.tsx                | 103 +++++
 .../shared/exploratory_view/index.tsx         |  64 +++
 .../shared/exploratory_view/rtl_helpers.tsx   | 318 ++++++++++++++
 .../columns/data_types_col.test.tsx           |  59 +++
 .../series_builder/columns/data_types_col.tsx |  56 +++
 .../columns/report_breakdowns.test.tsx        |  75 ++++
 .../columns/report_breakdowns.tsx             |  15 +
 .../columns/report_definition_col.test.tsx    |  75 ++++
 .../columns/report_definition_col.tsx         |  95 +++++
 .../columns/report_filters.test.tsx           |  28 ++
 .../series_builder/columns/report_filters.tsx |  22 +
 .../columns/report_types_col.test.tsx         |  65 +++
 .../columns/report_types_col.tsx              |  61 +++
 .../series_builder/custom_report_field.tsx    |  47 +++
 .../series_builder/series_builder.tsx         | 201 +++++++++
 .../series_date_picker/index.tsx              |  55 +++
 .../series_date_picker.test.tsx               |  76 ++++
 .../series_editor/columns/actions_col.tsx     |  31 ++
 .../series_editor/columns/breakdowns.test.tsx |  49 +++
 .../series_editor/columns/breakdowns.tsx      |  65 +++
 .../columns/chart_types.test.tsx              |  56 +++
 .../series_editor/columns/chart_types.tsx     | 149 +++++++
 .../series_editor/columns/date_picker_col.tsx |  20 +
 .../columns/filter_expanded.test.tsx          |  93 +++++
 .../series_editor/columns/filter_expanded.tsx | 100 +++++
 .../columns/filter_value_btn.test.tsx         | 238 +++++++++++
 .../columns/filter_value_btn.tsx              | 117 ++++++
 .../columns/metric_selection.test.tsx         | 112 +++++
 .../columns/metric_selection.tsx              |  86 ++++
 .../series_editor/columns/remove_series.tsx   |  35 ++
 .../series_editor/columns/series_filter.tsx   | 139 +++++++
 .../series_editor/selected_filters.test.tsx   |  33 ++
 .../series_editor/selected_filters.tsx        |  96 +++++
 .../series_editor/series_editor.tsx           | 139 +++++++
 .../shared/exploratory_view/types.ts          |  89 ++++
 .../field_value_selection.tsx                 |  19 +-
 .../shared/field_value_suggestions/index.tsx  |  24 +-
 .../public/context/has_data_context.test.tsx  |   9 +-
 .../public/context/has_data_context.tsx       |  46 ++-
 .../public/hooks/use_breadcrumbs.ts           |  71 ++++
 .../public/hooks/use_quick_time_ranges.tsx    |  22 +
 .../public/hooks/use_values_list.ts           |  46 ++-
 x-pack/plugins/observability/public/index.ts  |   1 +
 .../observability/public/routes/index.tsx     |  21 +
 .../utils/observability_index_patterns.ts     |  64 +++
 x-pack/plugins/observability/tsconfig.json    |   9 +-
 x-pack/plugins/uptime/public/apps/plugin.ts   |  27 +-
 82 files changed, 6058 insertions(+), 55 deletions(-)
 create mode 100644 x-pack/plugins/observability/public/assets/kibana_dashboard_dark.svg
 create mode 100644 x-pack/plugins/observability/public/assets/kibana_dashboard_light.svg
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/components/empty_view.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/components/filter_label.test.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/components/filter_label.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/constants.ts
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/cpu_usage_config.ts
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/data/elasticsearch_fieldnames.ts
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/data/sample_attribute.ts
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/data/test_index_pattern.json
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/default_configs.ts
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/kpi_trends_config.ts
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/lens_attributes.test.ts
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/lens_attributes.ts
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/logs_frequency_config.ts
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/memory_usage_config.ts
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/monitor_duration_config.ts
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/monitor_pings_config.ts
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/network_activity_config.ts
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/performance_dist_config.ts
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/service_latency_config.ts
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/service_throughput_config.ts
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/url_constants.ts
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/utils.ts
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/exploratory_view.test.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/exploratory_view.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/header/header.test.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/header/header.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/hooks/use_default_index_pattern.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/hooks/use_init_exploratory_view.ts
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/hooks/use_lens_attributes.ts
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/hooks/use_series_filters.ts
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/hooks/use_url_strorage.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/index.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/rtl_helpers.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/data_types_col.test.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/data_types_col.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/report_breakdowns.test.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/report_breakdowns.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/report_definition_col.test.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/report_definition_col.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/report_filters.test.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/report_filters.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/report_types_col.test.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/report_types_col.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/custom_report_field.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/series_builder.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/series_date_picker/index.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/series_date_picker/series_date_picker.test.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/actions_col.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/breakdowns.test.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/breakdowns.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/chart_types.test.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/chart_types.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/date_picker_col.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/filter_expanded.test.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/filter_expanded.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/filter_value_btn.test.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/filter_value_btn.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/metric_selection.test.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/metric_selection.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/remove_series.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/series_filter.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/selected_filters.test.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/selected_filters.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/series_editor.tsx
 create mode 100644 x-pack/plugins/observability/public/components/shared/exploratory_view/types.ts
 create mode 100644 x-pack/plugins/observability/public/hooks/use_breadcrumbs.ts
 create mode 100644 x-pack/plugins/observability/public/hooks/use_quick_time_ranges.tsx
 create mode 100644 x-pack/plugins/observability/public/utils/observability_index_patterns.ts

diff --git a/tsconfig.json b/tsconfig.json
index 03597114333ca..30944ac71fcc8 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -83,6 +83,7 @@
     "x-pack/plugins/uptime/server/lib/requests/helper.ts",
     "x-pack/plugins/uptime/public/lib/helper/rtl_helpers.tsx",
     "x-pack/plugins/uptime/public/lib/helper/enzyme_helpers.tsx",
+    "x-pack/plugins/observability/public/components/shared/exploratory_view/rtl_helpers.tsx",
     "x-pack/plugins/apm/server/utils/test_helpers.tsx",
     "x-pack/plugins/apm/public/utils/testHelpers.tsx",
 
diff --git a/x-pack/plugins/observability/kibana.json b/x-pack/plugins/observability/kibana.json
index 84aa1be9a8d87..5c47d0376581a 100644
--- a/x-pack/plugins/observability/kibana.json
+++ b/x-pack/plugins/observability/kibana.json
@@ -3,7 +3,7 @@
   "version": "8.0.0",
   "kibanaVersion": "kibana",
   "configPath": ["xpack", "observability"],
-  "optionalPlugins": ["licensing", "home", "usageCollection"],
+  "optionalPlugins": ["licensing", "home", "usageCollection","lens"],
   "requiredPlugins": ["data"],
   "ui": true,
   "server": true,
diff --git a/x-pack/plugins/observability/public/assets/kibana_dashboard_dark.svg b/x-pack/plugins/observability/public/assets/kibana_dashboard_dark.svg
new file mode 100644
index 0000000000000..834dd98d60e4c
--- /dev/null
+++ b/x-pack/plugins/observability/public/assets/kibana_dashboard_dark.svg
@@ -0,0 +1,116 @@
+<svg width="568" height="320" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <path fill="#25262E" d="M0 0h568v320H0z"/>
+  <g filter="url(#kibana_dashboard_dark__filter0_d)">
+    <rect x="24" y="172" width="248" height="124" rx="4" fill="#1D1E24"/>
+  </g>
+  <rect x="32" y="180" width="120" height="4" rx="2" fill="#A7AFBE"/>
+  <rect x="40" y="200" width="16" height="4" rx="2" fill="#535966"/>
+  <rect x="72" y="284" width="24" height="4" rx="2" fill="#535966"/>
+  <rect x="125" y="284" width="24" height="4" rx="2" fill="#535966"/>
+  <rect x="178" y="284" width="24" height="4" rx="2" fill="#535966"/>
+  <rect x="231" y="284" width="24" height="4" rx="2" fill="#535966"/>
+  <rect x="32" y="221" width="24" height="4" rx="2" fill="#535966"/>
+  <rect x="36" y="242" width="20" height="4" rx="2" fill="#535966"/>
+  <rect x="40" y="263" width="16" height="4" rx="2" transform="rotate(-.17 40 263)" fill="#535966"/>
+  <path d="M64.5 192.5v9.5m199 73.5H243M64.5 202h-4m4 0v21m0 0h-4m4 0v21m0 0h-4m4 0v21m0 0v10.5H84M64.5 265h-4M84 279.5v-4m0 0h53m0 0v4m0-4h53m0 0v4m0-4h53m0 0v4" stroke="#343741" stroke-linecap="round" stroke-linejoin="round"/>
+  <rect x="67" y="194" width="181" height="16" rx="1" fill="#54B399"/>
+  <rect x="67" y="236" width="59" height="16" rx="1" fill="#D36086"/>
+  <rect x="67" y="215" width="120" height="16" rx="1" fill="#6092C0"/>
+  <rect x="67" y="257" width="30" height="16" rx="1" fill="#9170B8"/>
+  <g filter="url(#kibana_dashboard_dark__filter1_d)">
+    <rect x="24" y="24" width="520" height="124" rx="4" fill="#1D1E24"/>
+  </g>
+  <rect x="32" y="32" width="101" height="4" rx="2" fill="#A7AFBE"/>
+  <rect x="38" y="52" width="18" height="4" rx="2" fill="#535966"/>
+  <rect x="32" y="73" width="24" height="4" rx="2" fill="#535966"/>
+  <rect x="40" y="94" width="16" height="4" rx="2" fill="#535966"/>
+  <rect x="36" y="115" width="20" height="4" rx="2" fill="#535966"/>
+  <rect x="72" y="136" width="24" height="4" rx="2" fill="#535966"/>
+  <rect x="216" y="136" width="24" height="4" rx="2" fill="#535966"/>
+  <rect x="360" y="136" width="24" height="4" rx="2" fill="#535966"/>
+  <rect x="504" y="136" width="24" height="4" rx="2" fill="#535966"/>
+  <path opacity=".1" d="M80.177 118L65 110v17h470.5V90.5l-15.177 12.692-15.178 1.346-15.177-8.846-15.178 17.885-15.177.961-15.178-5.384-15.177-.769-15.177 5.384-15.178-5.846-15.177-40.615-15.178 18.077-15.177-38.462L338.194 104l-15.178-16.308-15.177 12.923-15.178-9.538-15.177 5.615-15.178-24.384L247.129 71l-15.177-15.615-15.178 49.077-15.177 4.615-15.178-22.154-15.177-5.385L156.065 50l-15.178 37.923-15.177 6.923-15.178 19.692-15.177-4.692L80.177 118z" fill="#54B399"/>
+  <path d="M65 110l15.177 8 15.178-8.154 15.177 4.692 15.178-19.692 15.177-6.923L156.065 50l15.177 31.538 15.177 5.385 15.178 22.154 15.177-4.615 15.178-49.077L247.129 71l15.177 1.308 15.178 24.384 15.177-5.615 15.178 9.538 15.177-12.923L338.194 104l15.177-57.077 15.177 38.462 15.178-18.077 15.177 40.615 15.178 5.846 15.177-5.384 15.177.769 15.178 5.384 15.177-.961 15.178-17.885 15.177 8.846 15.178-1.346L535.5 90.5" stroke="#54B399" stroke-linecap="round" stroke-linejoin="round"/>
+  <circle opacity=".1" cx="100" cy="63" r="8" fill="#6092C0"/>
+  <circle opacity=".1" cx="232" cy="55" r="8" fill="#6092C0"/>
+  <circle opacity=".1" cx="323" cy="88" r="8" fill="#6092C0"/>
+  <circle opacity=".1" cx="353" cy="47" r="7.5" fill="#6092C0" stroke="#6092C0"/>
+  <circle opacity=".1" cx="523" cy="47" r="8" fill="#6092C0"/>
+  <circle opacity=".1" cx="106" cy="68" r="4" fill="#6092C0"/>
+  <circle opacity=".1" cx="156" cy="50" r="4" fill="#6092C0"/>
+  <circle opacity=".1" cx="240" cy="55" r="4" fill="#6092C0"/>
+  <circle opacity=".1" cx="262" cy="72" r="4" fill="#6092C0"/>
+  <circle opacity=".1" cx="345" cy="48" r="4" fill="#6092C0"/>
+  <circle opacity=".1" cx="484" cy="92" r="3.5" fill="#6092C0" stroke="#6092C0"/>
+  <circle opacity=".1" cx="490" cy="96" r="4" fill="#6092C0"/>
+  <circle cx="100" cy="63" r="7.5" stroke="#6092C0"/>
+  <circle cx="232" cy="55" r="7.5" stroke="#6092C0"/>
+  <circle cx="323" cy="88" r="7.5" stroke="#6092C0"/>
+  <circle cx="353" cy="47" r="7.5" stroke="#6092C0"/>
+  <circle cx="523" cy="47" r="7.5" stroke="#6092C0"/>
+  <circle cx="106" cy="68" r="3.5" stroke="#6092C0"/>
+  <circle cx="156" cy="50" r="3.5" stroke="#6092C0"/>
+  <circle cx="240" cy="55" r="3.5" stroke="#6092C0"/>
+  <circle cx="262" cy="72" r="3.5" stroke="#6092C0"/>
+  <circle cx="345" cy="48" r="3.5" stroke="#6092C0"/>
+  <circle cx="484" cy="92" r="3.5" stroke="#6092C0"/>
+  <circle cx="490" cy="96" r="3.5" stroke="#6092C0"/>
+  <path d="M64.5 44.5V54m471 73.5H516M64.5 54h-4m4 0v21m0 0h-4m4 0v21m0 0h-4m4 0v21m0 0v10.5H84M64.5 117h-4M84 131.5v-4m0 0h144m0 0v4m0-4h144m0 0v4m0-4h144m0 0v4" stroke="#343741" stroke-linecap="round" stroke-linejoin="round"/>
+  <g filter="url(#kibana_dashboard_dark__filter2_d)">
+    <rect x="296" y="172" width="248" height="124" rx="4" fill="#1D1E24"/>
+  </g>
+  <rect x="304" y="180" width="80" height="4" rx="2" fill="#A7AFBE"/>
+  <path d="M448.284 268.284a39.997 39.997 0 00-10.054-63.888 39.997 39.997 0 00-24.383-3.92l2.461 15.81a24 24 0 0120.663 40.685l11.313 11.313z" fill="#54B399"/>
+  <mask id="a" maskUnits="userSpaceOnUse" x="385" y="250" width="72" height="31" fill="#000">
+    <path fill="#fff" d="M385 250h72v31h-72z"/>
+    <path d="M386.416 261.728a39.996 39.996 0 0034.591 18.259 39.994 39.994 0 0033.628-19.976l-13.854-8.005a24 24 0 01-40.932 1.031l-13.433 8.691z"/>
+  </mask>
+  <path d="M386.416 261.728a39.996 39.996 0 0034.591 18.259 39.994 39.994 0 0033.628-19.976l-13.854-8.005a24 24 0 01-40.932 1.031l-13.433 8.691z" fill="#6092C0"/>
+  <path d="M386.416 261.728a39.996 39.996 0 0034.591 18.259 39.994 39.994 0 0033.628-19.976l-13.854-8.005a24 24 0 01-40.932 1.031l-13.433 8.691z" stroke="#1D1E24" stroke-width="2" mask="url(#a)"/>
+  <mask id="b" maskUnits="userSpaceOnUse" x="379" y="213" width="24" height="54" fill="#000">
+    <path fill="#fff" d="M379 213h24v54h-24z"/>
+    <path d="M388.645 215.163a40 40 0 00.54 50.341l12.326-10.202a24 24 0 01-.324-30.204l-12.542-9.935z"/>
+  </mask>
+  <path d="M388.645 215.163a40 40 0 00.54 50.341l12.326-10.202a24 24 0 01-.324-30.204l-12.542-9.935z" fill="#D36086"/>
+  <path d="M388.645 215.163a40 40 0 00.54 50.341l12.326-10.202a24 24 0 01-.324-30.204l-12.542-9.935z" stroke="#1D1E24" stroke-width="2" mask="url(#b)"/>
+  <mask id="c" maskUnits="userSpaceOnUse" x="384" y="199" width="37" height="30" fill="#000">
+    <path fill="#fff" d="M384 199h37v30h-37z"/>
+    <path d="M420 200a40.005 40.005 0 00-33.929 18.814l13.572 8.474A24.004 24.004 0 01420 216v-16z"/>
+  </mask>
+  <path d="M420 200a40.005 40.005 0 00-33.929 18.814l13.572 8.474A24.004 24.004 0 01420 216v-16z" fill="#9170B8"/>
+  <path d="M420 200a40.005 40.005 0 00-33.929 18.814l13.572 8.474A24.004 24.004 0 01420 216v-16z" stroke="#1D1E24" stroke-width="2" mask="url(#c)"/>
+  <rect x="367" y="192" width="22" height="4" rx="2" fill="#535966"/>
+  <rect x="345" y="250" width="16" height="4" rx="2" fill="#535966"/>
+  <rect x="441" y="284" width="24" height="4" rx="2" fill="#535966"/>
+  <rect x="471" y="210" width="24" height="4" rx="2" fill="#535966"/>
+  <path d="M393.5 194h4l4 8.5m65 9.5h-4l-7 4.5m-26.5 64l3.5 5.5h4m-58-41l-9 7h-4" stroke="#343741" stroke-linecap="round" stroke-linejoin="round"/>
+  <defs>
+    <filter id="kibana_dashboard_dark__filter0_d" x="8" y="160" width="280" height="156" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+      <feFlood flood-opacity="0" result="BackgroundImageFix"/>
+      <feColorMatrix in="SourceAlpha" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/>
+      <feOffset dy="4"/>
+      <feGaussianBlur stdDeviation="8"/>
+      <feColorMatrix values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.05 0"/>
+      <feBlend in2="BackgroundImageFix" result="effect1_dropShadow"/>
+      <feBlend in="SourceGraphic" in2="effect1_dropShadow" result="shape"/>
+    </filter>
+    <filter id="kibana_dashboard_dark__filter1_d" x="8" y="12" width="552" height="156" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+      <feFlood flood-opacity="0" result="BackgroundImageFix"/>
+      <feColorMatrix in="SourceAlpha" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/>
+      <feOffset dy="4"/>
+      <feGaussianBlur stdDeviation="8"/>
+      <feColorMatrix values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.05 0"/>
+      <feBlend in2="BackgroundImageFix" result="effect1_dropShadow"/>
+      <feBlend in="SourceGraphic" in2="effect1_dropShadow" result="shape"/>
+    </filter>
+    <filter id="kibana_dashboard_dark__filter2_d" x="280" y="160" width="280" height="156" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+      <feFlood flood-opacity="0" result="BackgroundImageFix"/>
+      <feColorMatrix in="SourceAlpha" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/>
+      <feOffset dy="4"/>
+      <feGaussianBlur stdDeviation="8"/>
+      <feColorMatrix values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.05 0"/>
+      <feBlend in2="BackgroundImageFix" result="effect1_dropShadow"/>
+      <feBlend in="SourceGraphic" in2="effect1_dropShadow" result="shape"/>
+    </filter>
+  </defs>
+</svg>
diff --git a/x-pack/plugins/observability/public/assets/kibana_dashboard_light.svg b/x-pack/plugins/observability/public/assets/kibana_dashboard_light.svg
new file mode 100644
index 0000000000000..958d25362c439
--- /dev/null
+++ b/x-pack/plugins/observability/public/assets/kibana_dashboard_light.svg
@@ -0,0 +1,116 @@
+<svg width="568" height="320" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <path fill="#F5F7FA" d="M0 0h568v320H0z"/>
+  <g filter="url(#kibana_dashboard_light__filter0_d)">
+    <rect x="24" y="172" width="248" height="124" rx="4" fill="#fff"/>
+  </g>
+  <rect x="32" y="180" width="120" height="4" rx="2" fill="#6A717D"/>
+  <rect x="40" y="200" width="16" height="4" rx="2" fill="#98A2B3"/>
+  <rect x="72" y="284" width="24" height="4" rx="2" fill="#98A2B3"/>
+  <rect x="125" y="284" width="24" height="4" rx="2" fill="#98A2B3"/>
+  <rect x="178" y="284" width="24" height="4" rx="2" fill="#98A2B3"/>
+  <rect x="231" y="284" width="24" height="4" rx="2" fill="#98A2B3"/>
+  <rect x="32" y="221" width="24" height="4" rx="2" fill="#98A2B3"/>
+  <rect x="36" y="242" width="20" height="4" rx="2" fill="#98A2B3"/>
+  <rect x="40" y="263" width="16" height="4" rx="2" transform="rotate(-.17 40 263)" fill="#98A2B3"/>
+  <path d="M64.5 192.5v9.5m199 73.5H243M64.5 202h-4m4 0v21m0 0h-4m4 0v21m0 0h-4m4 0v21m0 0v10.5H84M64.5 265h-4M84 279.5v-4m0 0h53m0 0v4m0-4h53m0 0v4m0-4h53m0 0v4" stroke="#D3DAE6" stroke-linecap="round" stroke-linejoin="round"/>
+  <rect x="67" y="194" width="181" height="16" rx="1" fill="#54B399"/>
+  <rect x="67" y="236" width="59" height="16" rx="1" fill="#D36086"/>
+  <rect x="67" y="215" width="120" height="16" rx="1" fill="#6092C0"/>
+  <rect x="67" y="257" width="30" height="16" rx="1" fill="#9170B8"/>
+  <g filter="url(#kibana_dashboard_light__filter1_d)">
+    <rect x="24" y="24" width="520" height="124" rx="4" fill="#fff"/>
+  </g>
+  <rect x="32" y="32" width="101" height="4" rx="2" fill="#6A717D"/>
+  <rect x="38" y="52" width="18" height="4" rx="2" fill="#98A2B3"/>
+  <rect x="32" y="73" width="24" height="4" rx="2" fill="#98A2B3"/>
+  <rect x="40" y="94" width="16" height="4" rx="2" fill="#98A2B3"/>
+  <rect x="36" y="115" width="20" height="4" rx="2" fill="#98A2B3"/>
+  <rect x="72" y="136" width="24" height="4" rx="2" fill="#98A2B3"/>
+  <rect x="216" y="136" width="24" height="4" rx="2" fill="#98A2B3"/>
+  <rect x="360" y="136" width="24" height="4" rx="2" fill="#98A2B3"/>
+  <rect x="504" y="136" width="24" height="4" rx="2" fill="#98A2B3"/>
+  <path opacity=".1" d="M80.177 118L65 110v17h470.5V90.5l-15.177 12.692-15.178 1.346-15.177-8.846-15.178 17.885-15.177.961-15.178-5.384-15.177-.769-15.177 5.384-15.178-5.846-15.177-40.615-15.178 18.077-15.177-38.462L338.194 104l-15.178-16.308-15.177 12.923-15.178-9.538-15.177 5.615-15.178-24.384L247.129 71l-15.177-15.615-15.178 49.077-15.177 4.615-15.178-22.154-15.177-5.385L156.065 50l-15.178 37.923-15.177 6.923-15.178 19.692-15.177-4.692L80.177 118z" fill="#54B399"/>
+  <path d="M65 110l15.177 8 15.178-8.154 15.177 4.692 15.178-19.692 15.177-6.923L156.065 50l15.177 31.538 15.177 5.385 15.178 22.154 15.177-4.615 15.178-49.077L247.129 71l15.177 1.308 15.178 24.384 15.177-5.615 15.178 9.538 15.177-12.923L338.194 104l15.177-57.077 15.177 38.462 15.178-18.077 15.177 40.615 15.178 5.846 15.177-5.384 15.177.769 15.178 5.384 15.177-.961 15.178-17.885 15.177 8.846 15.178-1.346L535.5 90.5" stroke="#54B399" stroke-linecap="round" stroke-linejoin="round"/>
+  <circle opacity=".1" cx="100" cy="63" r="7.5" fill="#6092C0" stroke="#6092C0"/>
+  <circle opacity=".1" cx="232" cy="55" r="7.5" fill="#6092C0" stroke="#6092C0"/>
+  <circle opacity=".1" cx="323" cy="88" r="7.5" fill="#6092C0" stroke="#6092C0"/>
+  <circle opacity=".1" cx="353" cy="47" r="7.5" fill="#6092C0" stroke="#6092C0"/>
+  <circle opacity=".1" cx="523" cy="47" r="7.5" fill="#6092C0" stroke="#6092C0"/>
+  <circle opacity=".1" cx="106" cy="68" r="3.5" fill="#6092C0" stroke="#6092C0"/>
+  <circle opacity=".1" cx="156" cy="50" r="3.5" fill="#6092C0" stroke="#6092C0"/>
+  <circle opacity=".1" cx="240" cy="55" r="3.5" fill="#6092C0" stroke="#6092C0"/>
+  <circle opacity=".1" cx="262" cy="72" r="3.5" fill="#6092C0" stroke="#6092C0"/>
+  <circle opacity=".1" cx="345" cy="48" r="3.5" fill="#6092C0" stroke="#6092C0"/>
+  <circle opacity=".1" cx="484" cy="92" r="3.5" fill="#6092C0" stroke="#6092C0"/>
+  <circle opacity=".1" cx="490" cy="96" r="3.5" fill="#6092C0" stroke="#6092C0"/>
+  <circle cx="100" cy="63" r="7.5" stroke="#6092C0"/>
+  <circle cx="232" cy="55" r="7.5" stroke="#6092C0"/>
+  <circle cx="323" cy="88" r="7.5" stroke="#6092C0"/>
+  <circle cx="353" cy="47" r="7.5" stroke="#6092C0"/>
+  <circle cx="523" cy="47" r="7.5" stroke="#6092C0"/>
+  <circle cx="106" cy="68" r="3.5" stroke="#6092C0"/>
+  <circle cx="156" cy="50" r="3.5" stroke="#6092C0"/>
+  <circle cx="240" cy="55" r="3.5" stroke="#6092C0"/>
+  <circle cx="262" cy="72" r="3.5" stroke="#6092C0"/>
+  <circle cx="345" cy="48" r="3.5" stroke="#6092C0"/>
+  <circle cx="484" cy="92" r="3.5" stroke="#6092C0"/>
+  <circle cx="490" cy="96" r="3.5" stroke="#6092C0"/>
+  <path d="M64.5 44.5V54m471 73.5H516M64.5 54h-4m4 0v21m0 0h-4m4 0v21m0 0h-4m4 0v21m0 0v10.5H84M64.5 117h-4M84 131.5v-4m0 0h144m0 0v4m0-4h144m0 0v4m0-4h144m0 0v4" stroke="#D3DAE6" stroke-linecap="round" stroke-linejoin="round"/>
+  <g filter="url(#kibana_dashboard_light__filter2_d)">
+    <rect x="296" y="172" width="248" height="124" rx="4" fill="#fff"/>
+  </g>
+  <rect x="304" y="180" width="80" height="4" rx="2" fill="#6A717D"/>
+  <path d="M448.284 268.284a39.997 39.997 0 00-10.054-63.888 39.997 39.997 0 00-24.383-3.92l2.461 15.81a24 24 0 0120.663 40.685l11.313 11.313z" fill="#54B399"/>
+  <mask id="a" maskUnits="userSpaceOnUse" x="385" y="250" width="72" height="31" fill="#000">
+    <path fill="#fff" d="M385 250h72v31h-72z"/>
+    <path d="M386.416 261.728a39.996 39.996 0 0034.591 18.259 39.994 39.994 0 0033.628-19.976l-13.854-8.005a24 24 0 01-40.932 1.031l-13.433 8.691z"/>
+  </mask>
+  <path d="M386.416 261.728a39.996 39.996 0 0034.591 18.259 39.994 39.994 0 0033.628-19.976l-13.854-8.005a24 24 0 01-40.932 1.031l-13.433 8.691z" fill="#6092C0"/>
+  <path d="M386.416 261.728a39.996 39.996 0 0034.591 18.259 39.994 39.994 0 0033.628-19.976l-13.854-8.005a24 24 0 01-40.932 1.031l-13.433 8.691z" stroke="#fff" stroke-width="2" mask="url(#a)"/>
+  <mask id="b" maskUnits="userSpaceOnUse" x="379" y="213" width="24" height="54" fill="#000">
+    <path fill="#fff" d="M379 213h24v54h-24z"/>
+    <path d="M388.645 215.163a40 40 0 00.54 50.341l12.326-10.202a24 24 0 01-.324-30.204l-12.542-9.935z"/>
+  </mask>
+  <path d="M388.645 215.163a40 40 0 00.54 50.341l12.326-10.202a24 24 0 01-.324-30.204l-12.542-9.935z" fill="#D36086"/>
+  <path d="M388.645 215.163a40 40 0 00.54 50.341l12.326-10.202a24 24 0 01-.324-30.204l-12.542-9.935z" stroke="#fff" stroke-width="2" mask="url(#b)"/>
+  <mask id="c" maskUnits="userSpaceOnUse" x="384" y="199" width="37" height="30" fill="#000">
+    <path fill="#fff" d="M384 199h37v30h-37z"/>
+    <path d="M420 200a40.005 40.005 0 00-33.929 18.814l13.572 8.474A24.004 24.004 0 01420 216v-16z"/>
+  </mask>
+  <path d="M420 200a40.005 40.005 0 00-33.929 18.814l13.572 8.474A24.004 24.004 0 01420 216v-16z" fill="#9170B8"/>
+  <path d="M420 200a40.005 40.005 0 00-33.929 18.814l13.572 8.474A24.004 24.004 0 01420 216v-16z" stroke="#fff" stroke-width="2" mask="url(#c)"/>
+  <rect x="367" y="192" width="22" height="4" rx="2" fill="#98A2B3"/>
+  <rect x="345" y="250" width="16" height="4" rx="2" fill="#98A2B3"/>
+  <rect x="441" y="284" width="24" height="4" rx="2" fill="#98A2B3"/>
+  <rect x="471" y="210" width="24" height="4" rx="2" fill="#98A2B3"/>
+  <path d="M393.5 194h4l4 8.5m65 9.5h-4l-7 4.5m-26.5 64l3.5 5.5h4m-58-41l-9 7h-4" stroke="#D3DAE6" stroke-linecap="round" stroke-linejoin="round"/>
+  <defs>
+    <filter id="kibana_dashboard_light__filter0_d" x="8" y="160" width="280" height="156" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+      <feFlood flood-opacity="0" result="BackgroundImageFix"/>
+      <feColorMatrix in="SourceAlpha" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/>
+      <feOffset dy="4"/>
+      <feGaussianBlur stdDeviation="8"/>
+      <feColorMatrix values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.05 0"/>
+      <feBlend in2="BackgroundImageFix" result="effect1_dropShadow"/>
+      <feBlend in="SourceGraphic" in2="effect1_dropShadow" result="shape"/>
+    </filter>
+    <filter id="kibana_dashboard_light__filter1_d" x="8" y="12" width="552" height="156" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+      <feFlood flood-opacity="0" result="BackgroundImageFix"/>
+      <feColorMatrix in="SourceAlpha" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/>
+      <feOffset dy="4"/>
+      <feGaussianBlur stdDeviation="8"/>
+      <feColorMatrix values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.05 0"/>
+      <feBlend in2="BackgroundImageFix" result="effect1_dropShadow"/>
+      <feBlend in="SourceGraphic" in2="effect1_dropShadow" result="shape"/>
+    </filter>
+    <filter id="kibana_dashboard_light__filter2_d" x="280" y="160" width="280" height="156" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+      <feFlood flood-opacity="0" result="BackgroundImageFix"/>
+      <feColorMatrix in="SourceAlpha" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"/>
+      <feOffset dy="4"/>
+      <feGaussianBlur stdDeviation="8"/>
+      <feColorMatrix values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.05 0"/>
+      <feBlend in2="BackgroundImageFix" result="effect1_dropShadow"/>
+      <feBlend in="SourceGraphic" in2="effect1_dropShadow" result="shape"/>
+    </filter>
+  </defs>
+</svg>
diff --git a/x-pack/plugins/observability/public/components/app/header/index.tsx b/x-pack/plugins/observability/public/components/app/header/index.tsx
index a41e3364d22b6..8b86e0b25379b 100644
--- a/x-pack/plugins/observability/public/components/app/header/index.tsx
+++ b/x-pack/plugins/observability/public/components/app/header/index.tsx
@@ -59,13 +59,13 @@ export function Header({ color, datePicker = null, restrictWidth }: Props) {
       </HeaderMenuPortal>
       <Wrapper restrictWidth={restrictWidth}>
         <EuiSpacer size="l" />
-        <EuiFlexGroup justifyContent="spaceBetween">
+        <EuiFlexGroup justifyContent="spaceBetween" alignItems="center">
           <EuiFlexItem>
             <EuiFlexGroup>
               <EuiFlexItem grow={false}>
                 <EuiIcon type="logoObservability" size="xxl" data-test-subj="observability-logo" />
               </EuiFlexItem>
-              <EuiFlexItem>
+              <EuiFlexItem grow={false} style={{ alignSelf: 'center' }}>
                 <EuiTitle>
                   <h1>
                     {i18n.translate('xpack.observability.home.title', {
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/components/empty_view.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/components/empty_view.tsx
new file mode 100644
index 0000000000000..17f1b039667d0
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/components/empty_view.tsx
@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { EuiImage } from '@elastic/eui';
+import styled from 'styled-components';
+import { useKibana } from '../../../../../../../../src/plugins/kibana_react/public';
+
+export function EmptyView() {
+  const {
+    services: { http },
+  } = useKibana();
+
+  return (
+    <Wrapper>
+      <EuiImage
+        alt="Visulization"
+        url={http!.basePath.prepend(`/plugins/observability/assets/kibana_dashboard_light.svg`)}
+      />
+    </Wrapper>
+  );
+}
+
+const Wrapper = styled.div`
+  text-align: center;
+  opacity: 0.4;
+  height: 550px;
+`;
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/components/filter_label.test.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/components/filter_label.test.tsx
new file mode 100644
index 0000000000000..37597e0ce513f
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/components/filter_label.test.tsx
@@ -0,0 +1,138 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { fireEvent, screen, waitFor } from '@testing-library/react';
+import { mockIndexPattern, render } from '../rtl_helpers';
+import { buildFilterLabel, FilterLabel } from './filter_label';
+import * as useSeriesHook from '../hooks/use_series_filters';
+
+describe('FilterLabel', function () {
+  const invertFilter = jest.fn();
+  jest.spyOn(useSeriesHook, 'useSeriesFilters').mockReturnValue({
+    invertFilter,
+  } as any);
+
+  it('should render properly', async function () {
+    render(
+      <FilterLabel
+        field={'service.name'}
+        value={'elastic-co'}
+        label={'Web Application'}
+        negate={false}
+        seriesId={'kpi-trends'}
+        removeFilter={jest.fn()}
+      />
+    );
+
+    await waitFor(() => {
+      screen.getByText('elastic-co');
+      screen.getByText(/web application:/i);
+      screen.getByTitle('Delete Web Application: elastic-co');
+      screen.getByRole('button', {
+        name: /delete web application: elastic-co/i,
+      });
+    });
+  });
+
+  it.skip('should delete filter', async function () {
+    const removeFilter = jest.fn();
+    render(
+      <FilterLabel
+        field={'service.name'}
+        value={'elastic-co'}
+        label={'Web Application'}
+        negate={false}
+        seriesId={'kpi-trends'}
+        removeFilter={removeFilter}
+      />
+    );
+
+    await waitFor(() => {
+      fireEvent.click(screen.getByLabelText('Filter actions'));
+    });
+
+    fireEvent.click(screen.getByTestId('deleteFilter'));
+    expect(removeFilter).toHaveBeenCalledTimes(1);
+    expect(removeFilter).toHaveBeenCalledWith('service.name', 'elastic-co', false);
+  });
+
+  it.skip('should invert filter', async function () {
+    const removeFilter = jest.fn();
+    render(
+      <FilterLabel
+        field={'service.name'}
+        value={'elastic-co'}
+        label={'Web Application'}
+        negate={false}
+        seriesId={'kpi-trends'}
+        removeFilter={removeFilter}
+      />
+    );
+
+    await waitFor(() => {
+      fireEvent.click(screen.getByLabelText('Filter actions'));
+    });
+
+    fireEvent.click(screen.getByTestId('negateFilter'));
+    expect(invertFilter).toHaveBeenCalledTimes(1);
+    expect(invertFilter).toHaveBeenCalledWith({
+      field: 'service.name',
+      negate: false,
+      value: 'elastic-co',
+    });
+  });
+
+  it('should display invert filter', async function () {
+    render(
+      <FilterLabel
+        field={'service.name'}
+        value={'elastic-co'}
+        label={'Web Application'}
+        negate={true}
+        seriesId={'kpi-trends'}
+        removeFilter={jest.fn()}
+      />
+    );
+
+    await waitFor(() => {
+      screen.getByText('elastic-co');
+      screen.getByText(/web application:/i);
+      screen.getByTitle('Delete NOT Web Application: elastic-co');
+      screen.getByRole('button', {
+        name: /delete not web application: elastic-co/i,
+      });
+    });
+  });
+
+  it('should build filter meta', function () {
+    expect(
+      buildFilterLabel({
+        field: 'user_agent.name',
+        label: 'Browser family',
+        indexPattern: mockIndexPattern,
+        value: 'Firefox',
+        negate: false,
+      })
+    ).toEqual({
+      meta: {
+        alias: null,
+        disabled: false,
+        index: 'apm-*',
+        key: 'Browser family',
+        negate: false,
+        type: 'phrase',
+        value: 'Firefox',
+      },
+      query: {
+        match_phrase: {
+          'user_agent.name': 'Firefox',
+        },
+      },
+    });
+  });
+});
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/components/filter_label.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/components/filter_label.tsx
new file mode 100644
index 0000000000000..3d6dc5b3f2bf5
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/components/filter_label.tsx
@@ -0,0 +1,90 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { injectI18n } from '@kbn/i18n/react';
+import { esFilters, Filter, IndexPattern } from '../../../../../../../../src/plugins/data/public';
+import { useIndexPatternContext } from '../hooks/use_default_index_pattern';
+import { useKibana } from '../../../../../../../../src/plugins/kibana_react/public';
+import { useSeriesFilters } from '../hooks/use_series_filters';
+
+interface Props {
+  field: string;
+  label: string;
+  value: string;
+  seriesId: string;
+  negate: boolean;
+  definitionFilter?: boolean;
+  removeFilter: (field: string, value: string, notVal: boolean) => void;
+}
+export function buildFilterLabel({
+  field,
+  value,
+  label,
+  indexPattern,
+  negate,
+}: {
+  label: string;
+  value: string;
+  negate: boolean;
+  field: string;
+  indexPattern: IndexPattern;
+}) {
+  const indexField = indexPattern.getFieldByName(field)!;
+
+  const filter = esFilters.buildPhraseFilter(indexField, value, indexPattern);
+
+  filter.meta.value = value;
+  filter.meta.key = label;
+  filter.meta.alias = null;
+  filter.meta.negate = negate;
+  filter.meta.disabled = false;
+  filter.meta.type = 'phrase';
+
+  return filter;
+}
+export function FilterLabel({
+  label,
+  seriesId,
+  field,
+  value,
+  negate,
+  removeFilter,
+  definitionFilter,
+}: Props) {
+  const FilterItem = injectI18n(esFilters.FilterItem);
+
+  const { indexPattern } = useIndexPatternContext();
+
+  const filter = buildFilterLabel({ field, value, label, indexPattern, negate });
+
+  const { invertFilter } = useSeriesFilters({ seriesId });
+
+  const {
+    services: { uiSettings },
+  } = useKibana();
+
+  return indexPattern ? (
+    <FilterItem
+      indexPatterns={[indexPattern]}
+      id={`${field}-${value}-${negate}`}
+      filter={filter}
+      onRemove={() => {
+        removeFilter(field, value, false);
+      }}
+      onUpdate={(filterN: Filter) => {
+        if (definitionFilter) {
+          // FIXME handle this use case
+        } else if (filterN.meta.negate !== negate) {
+          invertFilter({ field, value, negate });
+        }
+      }}
+      uiSettings={uiSettings!}
+      hiddenPanelOptions={['pinFilter', 'editFilter', 'disableFilter']}
+    />
+  ) : null;
+}
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/constants.ts b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/constants.ts
new file mode 100644
index 0000000000000..aa3ac2fa64317
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/constants.ts
@@ -0,0 +1,73 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { AppDataType, ReportViewTypeId } from '../types';
+import {
+  CLS_FIELD,
+  FCP_FIELD,
+  FID_FIELD,
+  LCP_FIELD,
+  TBT_FIELD,
+} from './data/elasticsearch_fieldnames';
+
+export const FieldLabels: Record<string, string> = {
+  'user_agent.name': 'Browser family',
+  'user_agent.version': 'Browser version',
+  'user_agent.os.name': 'Operating system',
+  'client.geo.country_name': 'Location',
+  'user_agent.device.name': 'Device',
+  'observer.geo.name': 'Observer location',
+  'service.name': 'Service Name',
+  'service.environment': 'Environment',
+
+  [LCP_FIELD]: 'Largest contentful paint',
+  [FCP_FIELD]: 'First contentful paint',
+  [TBT_FIELD]: 'Total blocking time',
+  [FID_FIELD]: 'First input delay',
+  [CLS_FIELD]: 'Cumulative layout shift',
+
+  'monitor.id': 'Monitor Id',
+  'monitor.status': 'Monitor Status',
+
+  'agent.hostname': 'Agent host',
+  'host.hostname': 'Host name',
+  'monitor.name': 'Monitor name',
+  'monitor.type': 'Monitor Type',
+  'url.port': 'Port',
+  tags: 'Tags',
+
+  // custom
+
+  'performance.metric': 'Metric',
+  'Business.KPI': 'KPI',
+};
+
+export const DataViewLabels: Record<ReportViewTypeId, string> = {
+  pld: 'Performance Distribution',
+  upd: 'Uptime monitor duration',
+  upp: 'Uptime pings',
+  svl: 'APM Service latency',
+  kpi: 'KPI over time',
+  tpt: 'APM Service throughput',
+  cpu: 'System CPU Usage',
+  logs: 'Logs Frequency',
+  mem: 'System Memory Usage',
+  nwk: 'Network Activity',
+};
+
+export const ReportToDataTypeMap: Record<ReportViewTypeId, AppDataType> = {
+  upd: 'synthetics',
+  upp: 'synthetics',
+  tpt: 'apm',
+  svl: 'apm',
+  kpi: 'rum',
+  pld: 'rum',
+  nwk: 'metrics',
+  mem: 'metrics',
+  logs: 'logs',
+  cpu: 'metrics',
+};
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/cpu_usage_config.ts b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/cpu_usage_config.ts
new file mode 100644
index 0000000000000..5a4fb2aa3a6a5
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/cpu_usage_config.ts
@@ -0,0 +1,42 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { DataSeries } from '../types';
+import { FieldLabels } from './constants';
+import { OperationType } from '../../../../../../lens/public';
+
+interface Props {
+  seriesId: string;
+}
+
+export function getCPUUsageLensConfig({ seriesId }: Props): DataSeries {
+  return {
+    id: seriesId,
+    reportType: 'cpu-usage',
+    defaultSeriesType: 'line',
+    seriesTypes: ['line', 'bar'],
+    xAxisColumn: {
+      sourceField: '@timestamp',
+    },
+    yAxisColumn: {
+      operationType: 'avg' as OperationType,
+      sourceField: 'system.cpu.user.pct',
+      label: 'CPU Usage %',
+    },
+    hasMetricType: true,
+    defaultFilters: [],
+    breakdowns: ['host.hostname'],
+    filters: [],
+    labels: { ...FieldLabels, 'host.hostname': 'Host name' },
+    reportDefinitions: [
+      {
+        field: 'agent.hostname',
+        required: true,
+      },
+    ],
+  };
+}
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/data/elasticsearch_fieldnames.ts b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/data/elasticsearch_fieldnames.ts
new file mode 100644
index 0000000000000..3faf54fff3140
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/data/elasticsearch_fieldnames.ts
@@ -0,0 +1,144 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export const CLOUD = 'cloud';
+export const CLOUD_AVAILABILITY_ZONE = 'cloud.availability_zone';
+export const CLOUD_PROVIDER = 'cloud.provider';
+export const CLOUD_REGION = 'cloud.region';
+export const CLOUD_MACHINE_TYPE = 'cloud.machine.type';
+
+export const SERVICE = 'service';
+export const SERVICE_NAME = 'service.name';
+export const SERVICE_ENVIRONMENT = 'service.environment';
+export const SERVICE_FRAMEWORK_NAME = 'service.framework.name';
+export const SERVICE_FRAMEWORK_VERSION = 'service.framework.version';
+export const SERVICE_LANGUAGE_NAME = 'service.language.name';
+export const SERVICE_LANGUAGE_VERSION = 'service.language.version';
+export const SERVICE_RUNTIME_NAME = 'service.runtime.name';
+export const SERVICE_RUNTIME_VERSION = 'service.runtime.version';
+export const SERVICE_NODE_NAME = 'service.node.name';
+export const SERVICE_VERSION = 'service.version';
+
+export const AGENT = 'agent';
+export const AGENT_NAME = 'agent.name';
+export const AGENT_VERSION = 'agent.version';
+
+export const URL_FULL = 'url.full';
+export const HTTP_REQUEST_METHOD = 'http.request.method';
+export const HTTP_RESPONSE_STATUS_CODE = 'http.response.status_code';
+export const USER_ID = 'user.id';
+export const USER_AGENT_ORIGINAL = 'user_agent.original';
+export const USER_AGENT_NAME = 'user_agent.name';
+export const USER_AGENT_VERSION = 'user_agent.version';
+
+export const DESTINATION_ADDRESS = 'destination.address';
+
+export const OBSERVER_HOSTNAME = 'observer.hostname';
+export const OBSERVER_VERSION_MAJOR = 'observer.version_major';
+export const OBSERVER_LISTENING = 'observer.listening';
+export const PROCESSOR_EVENT = 'processor.event';
+
+export const TRANSACTION_DURATION = 'transaction.duration.us';
+export const TRANSACTION_DURATION_HISTOGRAM = 'transaction.duration.histogram';
+export const TRANSACTION_TYPE = 'transaction.type';
+export const TRANSACTION_RESULT = 'transaction.result';
+export const TRANSACTION_NAME = 'transaction.name';
+export const TRANSACTION_ID = 'transaction.id';
+export const TRANSACTION_SAMPLED = 'transaction.sampled';
+export const TRANSACTION_BREAKDOWN_COUNT = 'transaction.breakdown.count';
+export const TRANSACTION_PAGE_URL = 'transaction.page.url';
+// for transaction metrics
+export const TRANSACTION_ROOT = 'transaction.root';
+
+export const EVENT_OUTCOME = 'event.outcome';
+
+export const TRACE_ID = 'trace.id';
+
+export const SPAN_DURATION = 'span.duration.us';
+export const SPAN_TYPE = 'span.type';
+export const SPAN_SUBTYPE = 'span.subtype';
+export const SPAN_SELF_TIME_SUM = 'span.self_time.sum.us';
+export const SPAN_ACTION = 'span.action';
+export const SPAN_NAME = 'span.name';
+export const SPAN_ID = 'span.id';
+export const SPAN_DESTINATION_SERVICE_RESOURCE = 'span.destination.service.resource';
+export const SPAN_DESTINATION_SERVICE_RESPONSE_TIME_COUNT =
+  'span.destination.service.response_time.count';
+
+export const SPAN_DESTINATION_SERVICE_RESPONSE_TIME_SUM =
+  'span.destination.service.response_time.sum.us';
+
+// Parent ID for a transaction or span
+export const PARENT_ID = 'parent.id';
+
+export const ERROR_GROUP_ID = 'error.grouping_key';
+export const ERROR_CULPRIT = 'error.culprit';
+export const ERROR_LOG_LEVEL = 'error.log.level';
+export const ERROR_LOG_MESSAGE = 'error.log.message';
+export const ERROR_EXC_MESSAGE = 'error.exception.message'; // only to be used in es queries, since error.exception is now an array
+export const ERROR_EXC_HANDLED = 'error.exception.handled'; // only to be used in es queries, since error.exception is now an array
+export const ERROR_EXC_TYPE = 'error.exception.type';
+export const ERROR_PAGE_URL = 'error.page.url';
+
+// METRICS
+export const METRIC_SYSTEM_FREE_MEMORY = 'system.memory.actual.free';
+export const METRIC_SYSTEM_TOTAL_MEMORY = 'system.memory.total';
+export const METRIC_SYSTEM_CPU_PERCENT = 'system.cpu.total.norm.pct';
+export const METRIC_PROCESS_CPU_PERCENT = 'system.process.cpu.total.norm.pct';
+export const METRIC_CGROUP_MEMORY_LIMIT_BYTES = 'system.process.cgroup.memory.mem.limit.bytes';
+export const METRIC_CGROUP_MEMORY_USAGE_BYTES = 'system.process.cgroup.memory.mem.usage.bytes';
+
+export const METRIC_JAVA_HEAP_MEMORY_MAX = 'jvm.memory.heap.max';
+export const METRIC_JAVA_HEAP_MEMORY_COMMITTED = 'jvm.memory.heap.committed';
+export const METRIC_JAVA_HEAP_MEMORY_USED = 'jvm.memory.heap.used';
+export const METRIC_JAVA_NON_HEAP_MEMORY_MAX = 'jvm.memory.non_heap.max';
+export const METRIC_JAVA_NON_HEAP_MEMORY_COMMITTED = 'jvm.memory.non_heap.committed';
+export const METRIC_JAVA_NON_HEAP_MEMORY_USED = 'jvm.memory.non_heap.used';
+export const METRIC_JAVA_THREAD_COUNT = 'jvm.thread.count';
+export const METRIC_JAVA_GC_COUNT = 'jvm.gc.count';
+export const METRIC_JAVA_GC_TIME = 'jvm.gc.time';
+
+export const LABEL_NAME = 'labels.name';
+
+export const HOST = 'host';
+export const HOST_NAME = 'host.hostname';
+export const HOST_OS_PLATFORM = 'host.os.platform';
+export const CONTAINER_ID = 'container.id';
+export const KUBERNETES = 'kubernetes';
+export const POD_NAME = 'kubernetes.pod.name';
+
+export const CLIENT_GEO_COUNTRY_ISO_CODE = 'client.geo.country_iso_code';
+export const CLIENT_GEO_COUNTRY_NAME = 'client.geo.country_name';
+
+// RUM Labels
+export const TRANSACTION_URL = 'url.full';
+export const CLIENT_GEO = 'client.geo';
+export const USER_AGENT_DEVICE = 'user_agent.device.name';
+export const USER_AGENT_OS = 'user_agent.os.name';
+
+export const TRANSACTION_TIME_TO_FIRST_BYTE = 'transaction.marks.agent.timeToFirstByte';
+export const TRANSACTION_DOM_INTERACTIVE = 'transaction.marks.agent.domInteractive';
+
+export const FCP_FIELD = 'transaction.marks.agent.firstContentfulPaint';
+export const LCP_FIELD = 'transaction.marks.agent.largestContentfulPaint';
+export const TBT_FIELD = 'transaction.experience.tbt';
+export const FID_FIELD = 'transaction.experience.fid';
+export const CLS_FIELD = 'transaction.experience.cls';
+
+export const PROFILE_ID = 'profile.id';
+export const PROFILE_DURATION = 'profile.duration';
+export const PROFILE_TOP_ID = 'profile.top.id';
+export const PROFILE_STACK = 'profile.stack';
+
+export const PROFILE_SAMPLES_COUNT = 'profile.samples.count';
+export const PROFILE_CPU_NS = 'profile.cpu.ns';
+export const PROFILE_WALL_US = 'profile.wall.us';
+
+export const PROFILE_ALLOC_OBJECTS = 'profile.alloc_objects.count';
+export const PROFILE_ALLOC_SPACE = 'profile.alloc_space.bytes';
+export const PROFILE_INUSE_OBJECTS = 'profile.inuse_objects.count';
+export const PROFILE_INUSE_SPACE = 'profile.inuse_space.bytes';
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/data/sample_attribute.ts b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/data/sample_attribute.ts
new file mode 100644
index 0000000000000..9b299e7d70bcc
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/data/sample_attribute.ts
@@ -0,0 +1,74 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+export const sampleAttribute = {
+  title: 'Prefilled from exploratory view app',
+  description: '',
+  visualizationType: 'lnsXY',
+  references: [
+    { id: 'apm-*', name: 'indexpattern-datasource-current-indexpattern', type: 'index-pattern' },
+    { id: 'apm-*', name: 'indexpattern-datasource-layer-layer1', type: 'index-pattern' },
+  ],
+  state: {
+    datasourceStates: {
+      indexpattern: {
+        layers: {
+          layer1: {
+            columnOrder: ['x-axis-column', 'y-axis-column'],
+            columns: {
+              'x-axis-column': {
+                sourceField: 'transaction.duration.us',
+                label: 'Page load time',
+                dataType: 'number',
+                operationType: 'range',
+                isBucketed: true,
+                scale: 'interval',
+                params: {
+                  type: 'histogram',
+                  ranges: [{ from: 0, to: 1000, label: '' }],
+                  maxBars: 'auto',
+                },
+              },
+              'y-axis-column': {
+                dataType: 'number',
+                isBucketed: false,
+                label: 'Pages loaded',
+                operationType: 'count',
+                scale: 'ratio',
+                sourceField: 'Records',
+              },
+            },
+            incompleteColumns: {},
+          },
+        },
+      },
+    },
+    visualization: {
+      legend: { isVisible: true, position: 'right' },
+      valueLabels: 'hide',
+      fittingFunction: 'Linear',
+      curveType: 'CURVE_MONOTONE_X',
+      axisTitlesVisibilitySettings: { x: true, yLeft: true, yRight: true },
+      tickLabelsVisibilitySettings: { x: true, yLeft: true, yRight: true },
+      gridlinesVisibilitySettings: { x: true, yLeft: true, yRight: true },
+      preferredSeriesType: 'line',
+      layers: [
+        {
+          accessors: ['y-axis-column'],
+          layerId: 'layer1',
+          seriesType: 'line',
+          yConfig: [{ forAccessor: 'y-axis-column', color: 'green' }],
+          xAccessor: 'x-axis-column',
+        },
+      ],
+    },
+    query: { query: '', language: 'kuery' },
+    filters: [
+      { meta: { index: 'apm-*' }, query: { match_phrase: { 'transaction.type': 'page-load' } } },
+      { meta: { index: 'apm-*' }, query: { match_phrase: { 'processor.event': 'transaction' } } },
+    ],
+  },
+};
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/data/test_index_pattern.json b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/data/test_index_pattern.json
new file mode 100644
index 0000000000000..31fec1fe8d4f4
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/data/test_index_pattern.json
@@ -0,0 +1,11 @@
+{
+  "attributes": {
+    "fieldFormatMap": "{\"client.bytes\":{\"id\":\"bytes\"},\"client.nat.port\":{\"id\":\"string\"},\"client.port\":{\"id\":\"string\"},\"destination.bytes\":{\"id\":\"bytes\"},\"destination.nat.port\":{\"id\":\"string\"},\"destination.port\":{\"id\":\"string\"},\"event.duration\":{\"id\":\"duration\",\"params\":{\"inputFormat\":\"nanoseconds\",\"outputFormat\":\"asMilliseconds\",\"outputPrecision\":1}},\"event.sequence\":{\"id\":\"string\"},\"event.severity\":{\"id\":\"string\"},\"http.request.body.bytes\":{\"id\":\"bytes\"},\"http.request.bytes\":{\"id\":\"bytes\"},\"http.response.body.bytes\":{\"id\":\"bytes\"},\"http.response.bytes\":{\"id\":\"bytes\"},\"http.response.status_code\":{\"id\":\"string\"},\"log.syslog.facility.code\":{\"id\":\"string\"},\"log.syslog.priority\":{\"id\":\"string\"},\"network.bytes\":{\"id\":\"bytes\"},\"package.size\":{\"id\":\"string\"},\"process.parent.pgid\":{\"id\":\"string\"},\"process.parent.pid\":{\"id\":\"string\"},\"process.parent.ppid\":{\"id\":\"string\"},\"process.parent.thread.id\":{\"id\":\"string\"},\"process.pgid\":{\"id\":\"string\"},\"process.pid\":{\"id\":\"string\"},\"process.ppid\":{\"id\":\"string\"},\"process.thread.id\":{\"id\":\"string\"},\"server.bytes\":{\"id\":\"bytes\"},\"server.nat.port\":{\"id\":\"string\"},\"server.port\":{\"id\":\"string\"},\"source.bytes\":{\"id\":\"bytes\"},\"source.nat.port\":{\"id\":\"string\"},\"source.port\":{\"id\":\"string\"},\"system.cpu.total.norm.pct\":{\"id\":\"percent\"},\"system.memory.actual.free\":{\"id\":\"bytes\"},\"system.memory.total\":{\"id\":\"bytes\"},\"system.process.cgroup.memory.mem.limit.bytes\":{\"id\":\"bytes\"},\"system.process.cgroup.memory.mem.usage.bytes\":{\"id\":\"bytes\"},\"system.process.cpu.total.norm.pct\":{\"id\":\"percent\"},\"system.process.memory.rss.bytes\":{\"id\":\"bytes\"},\"system.process.memory.size\":{\"id\":\"bytes\"},\"url.port\":{\"id\":\"string\"}}",
+    "fields": "[{\"name\":\"@timestamp\",\"type\":\"date\",\"esTypes\":[\"date\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"_id\",\"type\":\"string\",\"esTypes\":[\"_id\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_index\",\"type\":\"string\",\"esTypes\":[\"_index\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_score\",\"type\":\"number\",\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_source\",\"type\":\"_source\",\"esTypes\":[\"_source\"],\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_type\",\"type\":\"string\",\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"agent.build.original\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"agent.ephemeral_id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"agent.hostname\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"agent.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"agent.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"agent.type\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"agent.version\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"as.number\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"as.organization.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"as.organization.name.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"as.organization.name\"}}},{\"name\":\"child.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"client.address\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"client.as.number\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"client.as.organization.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"client.as.organization.name.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"client.as.organization.name\"}}},{\"name\":\"client.bytes\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"client.domain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"client.geo.city_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"client.geo.continent_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"client.geo.country_iso_code\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"client.geo.country_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"client.geo.location\",\"type\":\"geo_point\",\"esTypes\":[\"geo_point\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"client.geo.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"client.geo.region_iso_code\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"client.geo.region_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"client.ip\",\"type\":\"ip\",\"esTypes\":[\"ip\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"client.mac\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"client.nat.ip\",\"type\":\"ip\",\"esTypes\":[\"ip\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"client.nat.port\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"client.packets\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"client.port\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"client.registered_domain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"client.subdomain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"client.top_level_domain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"client.user.domain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"client.user.email\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"client.user.full_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"client.user.full_name.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"client.user.full_name\"}}},{\"name\":\"client.user.group.domain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"client.user.group.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"client.user.group.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"client.user.hash\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"client.user.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"client.user.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"client.user.name.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"client.user.name\"}}},{\"name\":\"client.user.roles\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"cloud.account.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"cloud.account.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"cloud.availability_zone\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"cloud.image.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"cloud.instance.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"cloud.instance.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"cloud.machine.type\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"cloud.project.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"cloud.project.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"cloud.provider\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"cloud.region\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"cloud.service.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"clr.gc.count\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"clr.gc.gen0size\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"clr.gc.gen1size\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"clr.gc.gen2size\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"clr.gc.gen3size\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"code_signature.exists\",\"type\":\"boolean\",\"esTypes\":[\"boolean\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"code_signature.status\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"code_signature.subject_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"code_signature.trusted\",\"type\":\"boolean\",\"esTypes\":[\"boolean\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"code_signature.valid\",\"type\":\"boolean\",\"esTypes\":[\"boolean\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"container.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"container.image.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"container.image.tag\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"container.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"container.runtime\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"destination.address\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"destination.as.number\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"destination.as.organization.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"destination.as.organization.name.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"destination.as.organization.name\"}}},{\"name\":\"destination.bytes\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"destination.domain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"destination.geo.city_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"destination.geo.continent_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"destination.geo.country_iso_code\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"destination.geo.country_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"destination.geo.location\",\"type\":\"geo_point\",\"esTypes\":[\"geo_point\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"destination.geo.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"destination.geo.region_iso_code\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"destination.geo.region_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"destination.ip\",\"type\":\"ip\",\"esTypes\":[\"ip\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"destination.mac\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"destination.nat.ip\",\"type\":\"ip\",\"esTypes\":[\"ip\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"destination.nat.port\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"destination.packets\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"destination.port\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"destination.registered_domain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"destination.subdomain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"destination.top_level_domain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"destination.user.domain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"destination.user.email\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"destination.user.full_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"destination.user.full_name.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"destination.user.full_name\"}}},{\"name\":\"destination.user.group.domain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"destination.user.group.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"destination.user.group.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"destination.user.hash\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"destination.user.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"destination.user.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"destination.user.name.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"destination.user.name\"}}},{\"name\":\"destination.user.roles\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dll.code_signature.exists\",\"type\":\"boolean\",\"esTypes\":[\"boolean\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dll.code_signature.status\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dll.code_signature.subject_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dll.code_signature.trusted\",\"type\":\"boolean\",\"esTypes\":[\"boolean\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dll.code_signature.valid\",\"type\":\"boolean\",\"esTypes\":[\"boolean\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dll.hash.md5\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dll.hash.sha1\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dll.hash.sha256\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dll.hash.sha512\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dll.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dll.path\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dll.pe.architecture\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dll.pe.company\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dll.pe.description\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dll.pe.file_version\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dll.pe.imphash\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dll.pe.original_file_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dll.pe.product\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dns.answers.class\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dns.answers.data\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dns.answers.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dns.answers.ttl\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dns.answers.type\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dns.header_flags\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dns.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dns.op_code\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dns.question.class\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dns.question.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dns.question.registered_domain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dns.question.subdomain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dns.question.top_level_domain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dns.question.type\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dns.resolved_ip\",\"type\":\"ip\",\"esTypes\":[\"ip\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dns.response_code\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"dns.type\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ecs.version\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"error.code\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"error.culprit\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"error.exception.code\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"error.exception.handled\",\"type\":\"boolean\",\"esTypes\":[\"boolean\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"error.exception.message\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"error.exception.module\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"error.exception.type\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"error.grouping_key\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"error.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"error.log.level\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"error.log.logger_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"error.log.message\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"error.log.param_message\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"error.message\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"error.stack_trace\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":false,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"error.stack_trace.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"error.stack_trace\"}}},{\"name\":\"error.type\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"event.action\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"event.category\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"event.code\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"event.created\",\"type\":\"date\",\"esTypes\":[\"date\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"event.dataset\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"event.duration\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"event.end\",\"type\":\"date\",\"esTypes\":[\"date\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"event.hash\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"event.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"event.ingested\",\"type\":\"date\",\"esTypes\":[\"date\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"event.kind\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"event.module\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"event.original\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":false,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"event.outcome\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"event.provider\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"event.reason\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"event.reference\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"event.risk_score\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"event.risk_score_norm\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"event.sequence\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"event.severity\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"event.start\",\"type\":\"date\",\"esTypes\":[\"date\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"event.timezone\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"event.type\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"event.url\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.accessed\",\"type\":\"date\",\"esTypes\":[\"date\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.attributes\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.code_signature.exists\",\"type\":\"boolean\",\"esTypes\":[\"boolean\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.code_signature.status\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.code_signature.subject_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.code_signature.trusted\",\"type\":\"boolean\",\"esTypes\":[\"boolean\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.code_signature.valid\",\"type\":\"boolean\",\"esTypes\":[\"boolean\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.created\",\"type\":\"date\",\"esTypes\":[\"date\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.ctime\",\"type\":\"date\",\"esTypes\":[\"date\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.device\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.directory\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.drive_letter\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.extension\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.gid\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.group\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.hash.md5\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.hash.sha1\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.hash.sha256\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.hash.sha512\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.inode\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.mime_type\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.mode\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.mtime\",\"type\":\"date\",\"esTypes\":[\"date\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.owner\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.path\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.path.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"file.path\"}}},{\"name\":\"file.pe.architecture\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.pe.company\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.pe.description\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.pe.file_version\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.pe.imphash\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.pe.original_file_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.pe.product\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.size\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.target_path\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.target_path.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"file.target_path\"}}},{\"name\":\"file.type\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.uid\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.x509.alternative_names\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.x509.issuer.common_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.x509.issuer.country\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.x509.issuer.distinguished_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.x509.issuer.locality\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.x509.issuer.organization\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.x509.issuer.organizational_unit\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.x509.issuer.state_or_province\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.x509.not_after\",\"type\":\"date\",\"esTypes\":[\"date\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.x509.not_before\",\"type\":\"date\",\"esTypes\":[\"date\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.x509.public_key_algorithm\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.x509.public_key_curve\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.x509.public_key_exponent\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":false,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.x509.public_key_size\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.x509.serial_number\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.x509.signature_algorithm\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.x509.subject.common_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.x509.subject.country\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.x509.subject.distinguished_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.x509.subject.locality\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.x509.subject.organization\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.x509.subject.organizational_unit\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.x509.subject.state_or_province\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"file.x509.version_number\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.city_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.continent_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.country_iso_code\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.country_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.location\",\"type\":\"geo_point\",\"esTypes\":[\"geo_point\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.region_iso_code\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.region_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"golang.goroutines\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"golang.heap.allocations.active\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"golang.heap.allocations.allocated\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"golang.heap.allocations.frees\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"golang.heap.allocations.idle\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"golang.heap.allocations.mallocs\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"golang.heap.allocations.objects\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"golang.heap.allocations.total\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"golang.heap.gc.cpu_fraction\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"golang.heap.gc.next_gc_limit\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"golang.heap.gc.total_count\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"golang.heap.gc.total_pause.ns\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"golang.heap.system.obtained\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"golang.heap.system.released\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"golang.heap.system.stack\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"golang.heap.system.total\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"group.domain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"group.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"group.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"hash.md5\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"hash.sha1\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"hash.sha256\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"hash.sha512\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.architecture\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.containerized\",\"type\":\"boolean\",\"esTypes\":[\"boolean\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.domain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.geo.city_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.geo.continent_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.geo.country_iso_code\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.geo.country_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.geo.location\",\"type\":\"geo_point\",\"esTypes\":[\"geo_point\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.geo.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.geo.region_iso_code\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.geo.region_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.hostname\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.ip\",\"type\":\"ip\",\"esTypes\":[\"ip\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.mac\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.os.build\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.os.codename\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.os.family\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.os.full\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.os.full.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"host.os.full\"}}},{\"name\":\"host.os.kernel\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.os.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.os.name.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"host.os.name\"}}},{\"name\":\"host.os.platform\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.os.version\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.type\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.uptime\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.user.domain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.user.email\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.user.full_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.user.full_name.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"host.user.full_name\"}}},{\"name\":\"host.user.group.domain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.user.group.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.user.group.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.user.hash\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.user.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.user.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host.user.name.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"host.user.name\"}}},{\"name\":\"host.user.roles\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"http.request.body.bytes\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"http.request.body.content\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"http.request.body.content.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"http.request.body.content\"}}},{\"name\":\"http.request.bytes\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"http.request.method\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"http.request.mime_type\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"http.request.referrer\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"http.response.body.bytes\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"http.response.body.content\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"http.response.body.content.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"http.response.body.content\"}}},{\"name\":\"http.response.bytes\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"http.response.finished\",\"type\":\"boolean\",\"esTypes\":[\"boolean\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"http.response.mime_type\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"http.response.status_code\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"http.version\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"interface.alias\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"interface.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"interface.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"jvm.gc.alloc\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"jvm.gc.count\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"jvm.gc.time\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"jvm.memory.heap.committed\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"jvm.memory.heap.max\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"jvm.memory.heap.pool.committed\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"jvm.memory.heap.pool.max\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"jvm.memory.heap.pool.used\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"jvm.memory.heap.used\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"jvm.memory.non_heap.committed\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"jvm.memory.non_heap.max\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"jvm.memory.non_heap.used\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"jvm.thread.count\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"kubernetes.container.image\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"kubernetes.container.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"kubernetes.deployment.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"kubernetes.namespace\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"kubernetes.node.hostname\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"kubernetes.node.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"kubernetes.pod.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"kubernetes.pod.uid\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"kubernetes.replicaset.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"kubernetes.statefulset.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"labels.city\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"labels.company\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"labels.country_code\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"labels.customer_email\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"labels.customer_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"labels.customer_tier\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"labels.env\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"labels.events_encoded\",\"type\":\"number\",\"esTypes\":[\"scaled_float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"labels.events_failed\",\"type\":\"number\",\"esTypes\":[\"scaled_float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"labels.events_original\",\"type\":\"number\",\"esTypes\":[\"scaled_float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"labels.events_published\",\"type\":\"number\",\"esTypes\":[\"scaled_float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"labels.foo\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"labels.git_rev\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"labels.hostname\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"labels.in_eu\",\"type\":\"boolean\",\"esTypes\":[\"boolean\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"labels.ip\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"labels.kibana_uuid\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"labels.lang\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"labels.lorem\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"labels.multi-line\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"labels.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"labels.plugin\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"labels.productId\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"labels.request_id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"labels.served_from_cache\",\"type\":\"conflict\",\"esTypes\":[\"boolean\",\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false,\"conflictDescriptions\":{\"boolean\":[\"apm-8.0.0-transaction-000001\"],\"keyword\":[\"apm-8.0.0-transaction-000002\"]}},{\"name\":\"labels.taskType\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"labels.this-is-a-very-long-tag-name-without-any-spaces\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"labels.u\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"labels.worker\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"log.file.path\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"log.level\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"log.logger\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"log.origin.file.line\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"log.origin.file.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"log.origin.function\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"log.original\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":false,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"log.syslog.facility.code\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"log.syslog.facility.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"log.syslog.priority\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"log.syslog.severity.code\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"log.syslog.severity.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"message\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"metricset.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"metricset.period\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"network.application\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"network.bytes\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"network.community_id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"network.direction\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"network.forwarded_ip\",\"type\":\"ip\",\"esTypes\":[\"ip\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"network.iana_number\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"network.inner.vlan.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"network.inner.vlan.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"network.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"network.packets\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"network.protocol\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"network.transport\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"network.type\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"network.vlan.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"network.vlan.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"nodejs.eventloop.delay.avg.ms\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"nodejs.eventloop.delay.ns\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"nodejs.handles.active\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"nodejs.memory.arrayBuffers.bytes\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"nodejs.memory.external.bytes\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"nodejs.memory.heap.allocated.bytes\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"nodejs.memory.heap.used.bytes\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"nodejs.requests.active\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.egress.interface.alias\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.egress.interface.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.egress.interface.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.egress.vlan.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.egress.vlan.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.egress.zone\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.geo.city_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.geo.continent_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.geo.country_iso_code\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.geo.country_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.geo.location\",\"type\":\"geo_point\",\"esTypes\":[\"geo_point\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.geo.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.geo.region_iso_code\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.geo.region_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.hostname\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.ingress.interface.alias\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.ingress.interface.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.ingress.interface.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.ingress.vlan.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.ingress.vlan.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.ingress.zone\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.ip\",\"type\":\"ip\",\"esTypes\":[\"ip\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.listening\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.mac\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.os.family\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.os.full\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.os.full.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"observer.os.full\"}}},{\"name\":\"observer.os.kernel\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.os.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.os.name.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"observer.os.name\"}}},{\"name\":\"observer.os.platform\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.os.version\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.product\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.serial_number\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.type\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.vendor\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.version\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"observer.version_major\",\"type\":\"number\",\"esTypes\":[\"byte\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"organization.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"organization.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"organization.name.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"organization.name\"}}},{\"name\":\"os.family\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"os.full\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"os.full.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"os.full\"}}},{\"name\":\"os.kernel\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"os.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"os.name.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"os.name\"}}},{\"name\":\"os.platform\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"os.version\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"package.architecture\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"package.build_version\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"package.checksum\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"package.description\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"package.install_scope\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"package.installed\",\"type\":\"date\",\"esTypes\":[\"date\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"package.license\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"package.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"package.path\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"package.reference\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"package.size\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"package.type\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"package.version\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"parent.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"pe.architecture\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"pe.company\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"pe.description\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"pe.file_version\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"pe.imphash\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"pe.original_file_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"pe.product\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.args\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.args_count\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.code_signature.exists\",\"type\":\"boolean\",\"esTypes\":[\"boolean\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.code_signature.status\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.code_signature.subject_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.code_signature.trusted\",\"type\":\"boolean\",\"esTypes\":[\"boolean\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.code_signature.valid\",\"type\":\"boolean\",\"esTypes\":[\"boolean\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.command_line\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.command_line.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"process.command_line\"}}},{\"name\":\"process.entity_id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.executable\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.executable.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"process.executable\"}}},{\"name\":\"process.exit_code\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.hash.md5\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.hash.sha1\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.hash.sha256\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.hash.sha512\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.name.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"process.name\"}}},{\"name\":\"process.parent.args\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.parent.args_count\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.parent.code_signature.exists\",\"type\":\"boolean\",\"esTypes\":[\"boolean\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.parent.code_signature.status\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.parent.code_signature.subject_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.parent.code_signature.trusted\",\"type\":\"boolean\",\"esTypes\":[\"boolean\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.parent.code_signature.valid\",\"type\":\"boolean\",\"esTypes\":[\"boolean\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.parent.command_line\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.parent.command_line.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"process.parent.command_line\"}}},{\"name\":\"process.parent.entity_id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.parent.executable\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.parent.executable.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"process.parent.executable\"}}},{\"name\":\"process.parent.exit_code\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.parent.hash.md5\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.parent.hash.sha1\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.parent.hash.sha256\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.parent.hash.sha512\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.parent.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.parent.name.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"process.parent.name\"}}},{\"name\":\"process.parent.pe.architecture\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.parent.pe.company\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.parent.pe.description\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.parent.pe.file_version\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.parent.pe.imphash\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.parent.pe.original_file_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.parent.pe.product\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.parent.pgid\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.parent.pid\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.parent.ppid\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.parent.start\",\"type\":\"date\",\"esTypes\":[\"date\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.parent.thread.id\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.parent.thread.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.parent.title\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.parent.title.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"process.parent.title\"}}},{\"name\":\"process.parent.uptime\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.parent.working_directory\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.parent.working_directory.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"process.parent.working_directory\"}}},{\"name\":\"process.pe.architecture\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.pe.company\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.pe.description\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.pe.file_version\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.pe.imphash\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.pe.original_file_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.pe.product\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.pgid\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.pid\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.ppid\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.start\",\"type\":\"date\",\"esTypes\":[\"date\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.thread.id\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.thread.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.title\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.uptime\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.working_directory\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"process.working_directory.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"process.working_directory\"}}},{\"name\":\"processor.event\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"processor.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"profile.alloc_objects.count\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"profile.alloc_space.bytes\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"profile.cpu.ns\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"profile.duration\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"profile.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"profile.inuse_objects.count\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"profile.inuse_space.bytes\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"profile.samples.count\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"profile.stack.filename\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"profile.stack.function\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"profile.stack.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"profile.stack.line\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"profile.top.filename\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"profile.top.function\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"profile.top.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"profile.top.line\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"registry.data.bytes\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"registry.data.strings\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"registry.data.type\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"registry.hive\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"registry.key\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"registry.path\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"registry.value\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"related.hash\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"related.hosts\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"related.ip\",\"type\":\"ip\",\"esTypes\":[\"ip\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"related.user\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ruby.gc.count\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ruby.heap.allocations.total\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ruby.heap.slots.free\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ruby.heap.slots.live\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ruby.threads\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"rule.author\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"rule.category\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"rule.description\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"rule.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"rule.license\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"rule.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"rule.reference\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"rule.ruleset\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"rule.uuid\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"rule.version\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"server.address\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"server.as.number\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"server.as.organization.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"server.as.organization.name.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"server.as.organization.name\"}}},{\"name\":\"server.bytes\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"server.domain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"server.geo.city_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"server.geo.continent_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"server.geo.country_iso_code\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"server.geo.country_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"server.geo.location\",\"type\":\"geo_point\",\"esTypes\":[\"geo_point\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"server.geo.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"server.geo.region_iso_code\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"server.geo.region_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"server.ip\",\"type\":\"ip\",\"esTypes\":[\"ip\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"server.mac\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"server.nat.ip\",\"type\":\"ip\",\"esTypes\":[\"ip\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"server.nat.port\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"server.packets\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"server.port\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"server.registered_domain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"server.subdomain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"server.top_level_domain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"server.user.domain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"server.user.email\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"server.user.full_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"server.user.full_name.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"server.user.full_name\"}}},{\"name\":\"server.user.group.domain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"server.user.group.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"server.user.group.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"server.user.hash\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"server.user.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"server.user.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"server.user.name.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"server.user.name\"}}},{\"name\":\"server.user.roles\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"service.environment\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"service.ephemeral_id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"service.framework.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"service.framework.version\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"service.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"service.language.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"service.language.version\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"service.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"service.node.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"service.runtime.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"service.runtime.version\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"service.state\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"service.type\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"service.version\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"source.address\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"source.as.number\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"source.as.organization.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"source.as.organization.name.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"source.as.organization.name\"}}},{\"name\":\"source.bytes\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"source.domain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"source.geo.city_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"source.geo.continent_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"source.geo.country_iso_code\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"source.geo.country_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"source.geo.location\",\"type\":\"geo_point\",\"esTypes\":[\"geo_point\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"source.geo.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"source.geo.region_iso_code\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"source.geo.region_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"source.ip\",\"type\":\"ip\",\"esTypes\":[\"ip\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"source.mac\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"source.nat.ip\",\"type\":\"ip\",\"esTypes\":[\"ip\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"source.nat.port\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"source.packets\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"source.port\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"source.registered_domain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"source.subdomain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"source.top_level_domain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"source.user.domain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"source.user.email\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"source.user.full_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"source.user.full_name.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"source.user.full_name\"}}},{\"name\":\"source.user.group.domain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"source.user.group.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"source.user.group.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"source.user.hash\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"source.user.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"source.user.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"source.user.name.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"source.user.name\"}}},{\"name\":\"source.user.roles\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sourcemap.bundle_filepath\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sourcemap.service.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sourcemap.service.version\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"span.action\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"span.db.link\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"span.db.rows_affected\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"span.destination.service.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"span.destination.service.resource\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"span.destination.service.response_time.count\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"span.destination.service.response_time.sum.us\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"span.destination.service.type\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"span.duration.us\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"span.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"span.message.age.ms\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"span.message.queue.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"span.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"span.self_time.count\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"span.self_time.sum.us\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"span.start.us\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"span.subtype\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"span.sync\",\"type\":\"boolean\",\"esTypes\":[\"boolean\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"span.type\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"system.cpu.total.norm.pct\",\"type\":\"number\",\"esTypes\":[\"scaled_float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"system.memory.actual.free\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"system.memory.total\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"system.process.cgroup.memory.mem.limit.bytes\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"system.process.cgroup.memory.mem.usage.bytes\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"system.process.cgroup.memory.stats.inactive_file.bytes\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"system.process.cpu.system.norm.pct\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"system.process.cpu.total.norm.pct\",\"type\":\"number\",\"esTypes\":[\"scaled_float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"system.process.cpu.user.norm.pct\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"system.process.memory.rss.bytes\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"system.process.memory.size\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tags\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"threat.framework\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"threat.tactic.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"threat.tactic.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"threat.tactic.reference\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"threat.technique.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"threat.technique.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"threat.technique.name.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"threat.technique.name\"}}},{\"name\":\"threat.technique.reference\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"threat.technique.subtechnique.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"threat.technique.subtechnique.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"threat.technique.subtechnique.name.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"threat.technique.subtechnique.name\"}}},{\"name\":\"threat.technique.subtechnique.reference\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"timeseries.instance\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"timestamp.us\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.cipher\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.certificate\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.certificate_chain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.hash.md5\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.hash.sha1\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.hash.sha256\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.issuer\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.ja3\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.not_after\",\"type\":\"date\",\"esTypes\":[\"date\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.not_before\",\"type\":\"date\",\"esTypes\":[\"date\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.server_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.subject\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.supported_ciphers\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.x509.alternative_names\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.x509.issuer.common_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.x509.issuer.country\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.x509.issuer.distinguished_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.x509.issuer.locality\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.x509.issuer.organization\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.x509.issuer.organizational_unit\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.x509.issuer.state_or_province\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.x509.not_after\",\"type\":\"date\",\"esTypes\":[\"date\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.x509.not_before\",\"type\":\"date\",\"esTypes\":[\"date\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.x509.public_key_algorithm\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.x509.public_key_curve\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.x509.public_key_exponent\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":false,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.x509.public_key_size\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.x509.serial_number\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.x509.signature_algorithm\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.x509.subject.common_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.x509.subject.country\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.x509.subject.distinguished_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.x509.subject.locality\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.x509.subject.organization\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.x509.subject.organizational_unit\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.x509.subject.state_or_province\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.client.x509.version_number\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.curve\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.established\",\"type\":\"boolean\",\"esTypes\":[\"boolean\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.next_protocol\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.resumed\",\"type\":\"boolean\",\"esTypes\":[\"boolean\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.certificate\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.certificate_chain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.hash.md5\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.hash.sha1\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.hash.sha256\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.issuer\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.ja3s\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.not_after\",\"type\":\"date\",\"esTypes\":[\"date\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.not_before\",\"type\":\"date\",\"esTypes\":[\"date\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.subject\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.x509.alternative_names\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.x509.issuer.common_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.x509.issuer.country\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.x509.issuer.distinguished_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.x509.issuer.locality\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.x509.issuer.organization\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.x509.issuer.organizational_unit\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.x509.issuer.state_or_province\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.x509.not_after\",\"type\":\"date\",\"esTypes\":[\"date\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.x509.not_before\",\"type\":\"date\",\"esTypes\":[\"date\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.x509.public_key_algorithm\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.x509.public_key_curve\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.x509.public_key_exponent\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":false,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.x509.public_key_size\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.x509.serial_number\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.x509.signature_algorithm\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.x509.subject.common_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.x509.subject.country\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.x509.subject.distinguished_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.x509.subject.locality\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.x509.subject.organization\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.x509.subject.organizational_unit\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.x509.subject.state_or_province\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.server.x509.version_number\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.version\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tls.version_protocol\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"trace.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.breakdown.count\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.duration.count\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.duration.histogram\",\"type\":\"histogram\",\"esTypes\":[\"histogram\"],\"searchable\":false,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.duration.sum.us\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.duration.us\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.experience.cls\",\"type\":\"number\",\"esTypes\":[\"scaled_float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.experience.fid\",\"type\":\"number\",\"esTypes\":[\"scaled_float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.experience.longtask.count\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.experience.longtask.max\",\"type\":\"number\",\"esTypes\":[\"scaled_float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.experience.longtask.sum\",\"type\":\"number\",\"esTypes\":[\"scaled_float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.experience.tbt\",\"type\":\"number\",\"esTypes\":[\"scaled_float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.marks.agent.domComplete\",\"type\":\"number\",\"esTypes\":[\"scaled_float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.marks.agent.domInteractive\",\"type\":\"number\",\"esTypes\":[\"scaled_float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.marks.agent.firstContentfulPaint\",\"type\":\"number\",\"esTypes\":[\"scaled_float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.marks.agent.largestContentfulPaint\",\"type\":\"number\",\"esTypes\":[\"scaled_float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.marks.agent.timeToFirstByte\",\"type\":\"number\",\"esTypes\":[\"scaled_float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.marks.navigationTiming.connectEnd\",\"type\":\"number\",\"esTypes\":[\"scaled_float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.marks.navigationTiming.connectStart\",\"type\":\"number\",\"esTypes\":[\"scaled_float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.marks.navigationTiming.domComplete\",\"type\":\"number\",\"esTypes\":[\"scaled_float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.marks.navigationTiming.domContentLoadedEventEnd\",\"type\":\"number\",\"esTypes\":[\"scaled_float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.marks.navigationTiming.domContentLoadedEventStart\",\"type\":\"number\",\"esTypes\":[\"scaled_float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.marks.navigationTiming.domInteractive\",\"type\":\"number\",\"esTypes\":[\"scaled_float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.marks.navigationTiming.domLoading\",\"type\":\"number\",\"esTypes\":[\"scaled_float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.marks.navigationTiming.domainLookupEnd\",\"type\":\"number\",\"esTypes\":[\"scaled_float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.marks.navigationTiming.domainLookupStart\",\"type\":\"number\",\"esTypes\":[\"scaled_float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.marks.navigationTiming.fetchStart\",\"type\":\"number\",\"esTypes\":[\"scaled_float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.marks.navigationTiming.loadEventEnd\",\"type\":\"number\",\"esTypes\":[\"scaled_float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.marks.navigationTiming.loadEventStart\",\"type\":\"number\",\"esTypes\":[\"scaled_float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.marks.navigationTiming.requestStart\",\"type\":\"number\",\"esTypes\":[\"scaled_float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.marks.navigationTiming.responseEnd\",\"type\":\"number\",\"esTypes\":[\"scaled_float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.marks.navigationTiming.responseStart\",\"type\":\"number\",\"esTypes\":[\"scaled_float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.message.age.ms\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.message.queue.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.name.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"transaction.name\"}}},{\"name\":\"transaction.result\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.root\",\"type\":\"boolean\",\"esTypes\":[\"boolean\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.sampled\",\"type\":\"boolean\",\"esTypes\":[\"boolean\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.self_time.count\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.self_time.sum.us\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.span_count.dropped\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"transaction.type\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"url.domain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"url.extension\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"url.fragment\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"url.full\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"url.original\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"url.original.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"url.original\"}}},{\"name\":\"url.password\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"url.path\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"url.port\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"url.query\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"url.registered_domain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"url.scheme\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"url.subdomain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"url.top_level_domain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"url.username\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"user.domain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"user.email\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"user.full_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"user.full_name.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"user.full_name\"}}},{\"name\":\"user.group.domain\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"user.group.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"user.group.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"user.hash\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"user.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"user.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"user.roles\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"user_agent.device.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"user_agent.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"user_agent.original\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"user_agent.original.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"user_agent.original\"}}},{\"name\":\"user_agent.os.family\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"user_agent.os.full\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"user_agent.os.kernel\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"user_agent.os.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"user_agent.os.platform\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"user_agent.os.version\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"user_agent.version\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"vlan.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"vlan.name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"vulnerability.category\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"vulnerability.classification\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"vulnerability.description\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"vulnerability.description.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"vulnerability.description\"}}},{\"name\":\"vulnerability.enumeration\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"vulnerability.id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"vulnerability.reference\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"vulnerability.report_id\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"vulnerability.scanner.vendor\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"vulnerability.score.base\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"vulnerability.score.environmental\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"vulnerability.score.temporal\",\"type\":\"number\",\"esTypes\":[\"float\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"vulnerability.score.version\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"vulnerability.severity\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"x509.alternative_names\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"x509.issuer.common_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"x509.issuer.country\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"x509.issuer.distinguished_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"x509.issuer.locality\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"x509.issuer.organization\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"x509.issuer.organizational_unit\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"x509.issuer.state_or_province\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"x509.not_after\",\"type\":\"date\",\"esTypes\":[\"date\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"x509.not_before\",\"type\":\"date\",\"esTypes\":[\"date\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"x509.public_key_algorithm\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"x509.public_key_curve\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"x509.public_key_exponent\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":false,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"x509.public_key_size\",\"type\":\"number\",\"esTypes\":[\"long\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"x509.serial_number\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"x509.signature_algorithm\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"x509.subject.common_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"x509.subject.country\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"x509.subject.distinguished_name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"x509.subject.locality\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"x509.subject.organization\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"x509.subject.organizational_unit\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"x509.subject.state_or_province\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"x509.version_number\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true}]",
+    "sourceFilters": "[{\"value\":\"sourcemap.sourcemap\"}]",
+    "timeFieldName": "@timestamp"
+  },
+  "id": "apm-*",
+  "type": "index-pattern",
+  "version": "1"
+}
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/default_configs.ts b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/default_configs.ts
new file mode 100644
index 0000000000000..85d48ef638d44
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/default_configs.ts
@@ -0,0 +1,52 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ReportViewTypes } from '../types';
+import { getPerformanceDistLensConfig } from './performance_dist_config';
+import { getMonitorDurationConfig } from './monitor_duration_config';
+import { getServiceLatencyLensConfig } from './service_latency_config';
+import { getMonitorPingsConfig } from './monitor_pings_config';
+import { getServiceThroughputLensConfig } from './service_throughput_config';
+import { getKPITrendsLensConfig } from './kpi_trends_config';
+import { getCPUUsageLensConfig } from './cpu_usage_config';
+import { getMemoryUsageLensConfig } from './memory_usage_config';
+import { getNetworkActivityLensConfig } from './network_activity_config';
+import { getLogsFrequencyLensConfig } from './logs_frequency_config';
+import { IIndexPattern } from '../../../../../../../../src/plugins/data/common/index_patterns';
+
+interface Props {
+  reportType: keyof typeof ReportViewTypes;
+  seriesId: string;
+  indexPattern: IIndexPattern;
+}
+
+export const getDefaultConfigs = ({ reportType, seriesId, indexPattern }: Props) => {
+  switch (ReportViewTypes[reportType]) {
+    case 'page-load-dist':
+      return getPerformanceDistLensConfig({ seriesId, indexPattern });
+    case 'kpi-trends':
+      return getKPITrendsLensConfig({ seriesId, indexPattern });
+    case 'uptime-duration':
+      return getMonitorDurationConfig({ seriesId });
+    case 'uptime-pings':
+      return getMonitorPingsConfig({ seriesId });
+    case 'service-latency':
+      return getServiceLatencyLensConfig({ seriesId, indexPattern });
+    case 'service-throughput':
+      return getServiceThroughputLensConfig({ seriesId, indexPattern });
+    case 'cpu-usage':
+      return getCPUUsageLensConfig({ seriesId });
+    case 'memory-usage':
+      return getMemoryUsageLensConfig({ seriesId });
+    case 'network-activity':
+      return getNetworkActivityLensConfig({ seriesId });
+    case 'logs-frequency':
+      return getLogsFrequencyLensConfig({ seriesId });
+    default:
+      return getKPITrendsLensConfig({ seriesId, indexPattern });
+  }
+};
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/kpi_trends_config.ts b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/kpi_trends_config.ts
new file mode 100644
index 0000000000000..a967a8824bca7
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/kpi_trends_config.ts
@@ -0,0 +1,73 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ConfigProps, DataSeries } from '../types';
+import { FieldLabels } from './constants';
+import { buildPhraseFilter } from './utils';
+import {
+  CLIENT_GEO_COUNTRY_NAME,
+  PROCESSOR_EVENT,
+  SERVICE_ENVIRONMENT,
+  SERVICE_NAME,
+  TRANSACTION_TYPE,
+  USER_AGENT_DEVICE,
+  USER_AGENT_NAME,
+  USER_AGENT_OS,
+  USER_AGENT_VERSION,
+} from './data/elasticsearch_fieldnames';
+
+export function getKPITrendsLensConfig({ seriesId, indexPattern }: ConfigProps): DataSeries {
+  return {
+    id: seriesId,
+    defaultSeriesType: 'bar_stacked',
+    reportType: 'kpi-trends',
+    seriesTypes: ['bar', 'bar_stacked'],
+    xAxisColumn: {
+      sourceField: '@timestamp',
+    },
+    yAxisColumn: {
+      operationType: 'count',
+      label: 'Page views',
+    },
+    hasMetricType: false,
+    defaultFilters: [
+      USER_AGENT_OS,
+      CLIENT_GEO_COUNTRY_NAME,
+      USER_AGENT_DEVICE,
+      {
+        field: USER_AGENT_NAME,
+        nested: USER_AGENT_VERSION,
+      },
+    ],
+    breakdowns: [USER_AGENT_NAME, USER_AGENT_OS, CLIENT_GEO_COUNTRY_NAME, USER_AGENT_DEVICE],
+    filters: [
+      buildPhraseFilter(TRANSACTION_TYPE, 'page-load', indexPattern),
+      buildPhraseFilter(PROCESSOR_EVENT, 'transaction', indexPattern),
+    ],
+    labels: { ...FieldLabels, SERVICE_NAME: 'Web Application' },
+    reportDefinitions: [
+      {
+        field: SERVICE_NAME,
+        required: true,
+      },
+      {
+        field: SERVICE_ENVIRONMENT,
+      },
+      {
+        field: 'Business.KPI',
+        custom: true,
+        defaultValue: 'Records',
+        options: [
+          {
+            field: 'Records',
+            label: 'Page views',
+          },
+        ],
+      },
+    ],
+  };
+}
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/lens_attributes.test.ts b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/lens_attributes.test.ts
new file mode 100644
index 0000000000000..dcfaed938cc0f
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/lens_attributes.test.ts
@@ -0,0 +1,387 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { LensAttributes } from './lens_attributes';
+import { mockIndexPattern } from '../rtl_helpers';
+import { getDefaultConfigs } from './default_configs';
+import { sampleAttribute } from './data/sample_attribute';
+import { LCP_FIELD, SERVICE_NAME } from './data/elasticsearch_fieldnames';
+import { USER_AGENT_NAME } from './data/elasticsearch_fieldnames';
+
+describe('Lens Attribute', () => {
+  const reportViewConfig = getDefaultConfigs({
+    reportType: 'pld',
+    indexPattern: mockIndexPattern,
+    seriesId: 'series-id',
+  });
+
+  let lnsAttr: LensAttributes;
+
+  beforeEach(() => {
+    lnsAttr = new LensAttributes(mockIndexPattern, reportViewConfig, 'line', [], 'count', {});
+  });
+
+  it('should return expected json', function () {
+    expect(lnsAttr.getJSON()).toEqual(sampleAttribute);
+  });
+
+  it('should return main y axis', function () {
+    expect(lnsAttr.getMainYAxis()).toEqual({
+      dataType: 'number',
+      isBucketed: false,
+      label: 'Pages loaded',
+      operationType: 'count',
+      scale: 'ratio',
+      sourceField: 'Records',
+    });
+  });
+
+  it('should return expected field type', function () {
+    expect(JSON.stringify(lnsAttr.getFieldMeta('transaction.type'))).toEqual(
+      JSON.stringify({
+        count: 0,
+        name: 'transaction.type',
+        type: 'string',
+        esTypes: ['keyword'],
+        scripted: false,
+        searchable: true,
+        aggregatable: true,
+        readFromDocValues: true,
+      })
+    );
+  });
+
+  it('should return expected field type for custom field with default value', function () {
+    expect(JSON.stringify(lnsAttr.getFieldMeta('performance.metric'))).toEqual(
+      JSON.stringify({
+        count: 0,
+        name: 'transaction.duration.us',
+        type: 'number',
+        esTypes: ['long'],
+        scripted: false,
+        searchable: true,
+        aggregatable: true,
+        readFromDocValues: true,
+      })
+    );
+  });
+
+  it('should return expected field type for custom field with passed value', function () {
+    lnsAttr = new LensAttributes(mockIndexPattern, reportViewConfig, 'line', [], 'count', {
+      'performance.metric': LCP_FIELD,
+    });
+
+    expect(JSON.stringify(lnsAttr.getFieldMeta('performance.metric'))).toEqual(
+      JSON.stringify({
+        count: 0,
+        name: LCP_FIELD,
+        type: 'number',
+        esTypes: ['scaled_float'],
+        scripted: false,
+        searchable: true,
+        aggregatable: true,
+        readFromDocValues: true,
+      })
+    );
+  });
+
+  it('should return expected number column', function () {
+    expect(lnsAttr.getNumberColumn('transaction.duration.us')).toEqual({
+      dataType: 'number',
+      isBucketed: true,
+      label: 'Page load time',
+      operationType: 'range',
+      params: {
+        maxBars: 'auto',
+        ranges: [
+          {
+            from: 0,
+            label: '',
+            to: 1000,
+          },
+        ],
+        type: 'histogram',
+      },
+      scale: 'interval',
+      sourceField: 'transaction.duration.us',
+    });
+  });
+
+  it('should return expected date histogram column', function () {
+    expect(lnsAttr.getDateHistogramColumn('@timestamp')).toEqual({
+      dataType: 'date',
+      isBucketed: true,
+      label: '@timestamp',
+      operationType: 'date_histogram',
+      params: {
+        interval: 'auto',
+      },
+      scale: 'interval',
+      sourceField: '@timestamp',
+    });
+  });
+
+  it('should return main x axis', function () {
+    expect(lnsAttr.getXAxis()).toEqual({
+      dataType: 'number',
+      isBucketed: true,
+      label: 'Page load time',
+      operationType: 'range',
+      params: {
+        maxBars: 'auto',
+        ranges: [
+          {
+            from: 0,
+            label: '',
+            to: 1000,
+          },
+        ],
+        type: 'histogram',
+      },
+      scale: 'interval',
+      sourceField: 'transaction.duration.us',
+    });
+  });
+
+  it('should return first layer', function () {
+    expect(lnsAttr.getLayer()).toEqual({
+      columnOrder: ['x-axis-column', 'y-axis-column'],
+      columns: {
+        'x-axis-column': {
+          dataType: 'number',
+          isBucketed: true,
+          label: 'Page load time',
+          operationType: 'range',
+          params: {
+            maxBars: 'auto',
+            ranges: [
+              {
+                from: 0,
+                label: '',
+                to: 1000,
+              },
+            ],
+            type: 'histogram',
+          },
+          scale: 'interval',
+          sourceField: 'transaction.duration.us',
+        },
+        'y-axis-column': {
+          dataType: 'number',
+          isBucketed: false,
+          label: 'Pages loaded',
+          operationType: 'count',
+          scale: 'ratio',
+          sourceField: 'Records',
+        },
+      },
+      incompleteColumns: {},
+    });
+  });
+
+  it('should return expected XYState', function () {
+    expect(lnsAttr.getXyState()).toEqual({
+      axisTitlesVisibilitySettings: { x: true, yLeft: true, yRight: true },
+      curveType: 'CURVE_MONOTONE_X',
+      fittingFunction: 'Linear',
+      gridlinesVisibilitySettings: { x: true, yLeft: true, yRight: true },
+      layers: [
+        {
+          accessors: ['y-axis-column'],
+          layerId: 'layer1',
+          palette: undefined,
+          seriesType: 'line',
+          xAccessor: 'x-axis-column',
+          yConfig: [{ color: 'green', forAccessor: 'y-axis-column' }],
+        },
+      ],
+      legend: { isVisible: true, position: 'right' },
+      preferredSeriesType: 'line',
+      tickLabelsVisibilitySettings: { x: true, yLeft: true, yRight: true },
+      valueLabels: 'hide',
+    });
+  });
+
+  describe('ParseFilters function', function () {
+    it('should parse default filters', function () {
+      expect(lnsAttr.parseFilters()).toEqual([
+        { meta: { index: 'apm-*' }, query: { match_phrase: { 'transaction.type': 'page-load' } } },
+        { meta: { index: 'apm-*' }, query: { match_phrase: { 'processor.event': 'transaction' } } },
+      ]);
+    });
+
+    it('should parse default and ui filters', function () {
+      lnsAttr = new LensAttributes(
+        mockIndexPattern,
+        reportViewConfig,
+        'line',
+        [
+          { field: SERVICE_NAME, values: ['elastic-co', 'kibana-front'] },
+          { field: USER_AGENT_NAME, values: ['Firefox'], notValues: ['Chrome'] },
+        ],
+        'count',
+        {}
+      );
+
+      expect(lnsAttr.parseFilters()).toEqual([
+        { meta: { index: 'apm-*' }, query: { match_phrase: { 'transaction.type': 'page-load' } } },
+        { meta: { index: 'apm-*' }, query: { match_phrase: { 'processor.event': 'transaction' } } },
+        {
+          meta: {
+            index: 'apm-*',
+            key: 'service.name',
+            params: ['elastic-co', 'kibana-front'],
+            type: 'phrases',
+            value: 'elastic-co, kibana-front',
+          },
+          query: {
+            bool: {
+              minimum_should_match: 1,
+              should: [
+                {
+                  match_phrase: {
+                    'service.name': 'elastic-co',
+                  },
+                },
+                {
+                  match_phrase: {
+                    'service.name': 'kibana-front',
+                  },
+                },
+              ],
+            },
+          },
+        },
+        {
+          meta: {
+            index: 'apm-*',
+          },
+          query: {
+            match_phrase: {
+              'user_agent.name': 'Firefox',
+            },
+          },
+        },
+        {
+          meta: {
+            index: 'apm-*',
+            negate: true,
+          },
+          query: {
+            match_phrase: {
+              'user_agent.name': 'Chrome',
+            },
+          },
+        },
+      ]);
+    });
+  });
+
+  describe('Layer breakdowns', function () {
+    it('should add breakdown column', function () {
+      lnsAttr.addBreakdown(USER_AGENT_NAME);
+
+      expect(lnsAttr.visualization.layers).toEqual([
+        {
+          accessors: ['y-axis-column'],
+          layerId: 'layer1',
+          palette: undefined,
+          seriesType: 'line',
+          splitAccessor: 'break-down-column',
+          xAccessor: 'x-axis-column',
+          yConfig: [{ color: 'green', forAccessor: 'y-axis-column' }],
+        },
+      ]);
+
+      expect(lnsAttr.layers.layer1).toEqual({
+        columnOrder: ['x-axis-column', 'break-down-column', 'y-axis-column'],
+        columns: {
+          'break-down-column': {
+            dataType: 'string',
+            isBucketed: true,
+            label: 'Top values of Browser family',
+            operationType: 'terms',
+            params: {
+              missingBucket: false,
+              orderBy: { columnId: 'y-axis-column', type: 'column' },
+              orderDirection: 'desc',
+              otherBucket: true,
+              size: 3,
+            },
+            scale: 'ordinal',
+            sourceField: 'user_agent.name',
+          },
+          'x-axis-column': {
+            dataType: 'number',
+            isBucketed: true,
+            label: 'Page load time',
+            operationType: 'range',
+            params: {
+              maxBars: 'auto',
+              ranges: [{ from: 0, label: '', to: 1000 }],
+              type: 'histogram',
+            },
+            scale: 'interval',
+            sourceField: 'transaction.duration.us',
+          },
+          'y-axis-column': {
+            dataType: 'number',
+            isBucketed: false,
+            label: 'Pages loaded',
+            operationType: 'count',
+            scale: 'ratio',
+            sourceField: 'Records',
+          },
+        },
+        incompleteColumns: {},
+      });
+    });
+
+    it('should remove breakdown column', function () {
+      lnsAttr.addBreakdown(USER_AGENT_NAME);
+
+      lnsAttr.removeBreakdown();
+
+      expect(lnsAttr.visualization.layers).toEqual([
+        {
+          accessors: ['y-axis-column'],
+          layerId: 'layer1',
+          palette: undefined,
+          seriesType: 'line',
+          xAccessor: 'x-axis-column',
+          yConfig: [{ color: 'green', forAccessor: 'y-axis-column' }],
+        },
+      ]);
+
+      expect(lnsAttr.layers.layer1.columnOrder).toEqual(['x-axis-column', 'y-axis-column']);
+
+      expect(lnsAttr.layers.layer1.columns).toEqual({
+        'x-axis-column': {
+          dataType: 'number',
+          isBucketed: true,
+          label: 'Page load time',
+          operationType: 'range',
+          params: {
+            maxBars: 'auto',
+            ranges: [{ from: 0, label: '', to: 1000 }],
+            type: 'histogram',
+          },
+          scale: 'interval',
+          sourceField: 'transaction.duration.us',
+        },
+        'y-axis-column': {
+          dataType: 'number',
+          isBucketed: false,
+          label: 'Pages loaded',
+          operationType: 'count',
+          scale: 'ratio',
+          sourceField: 'Records',
+        },
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/lens_attributes.ts b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/lens_attributes.ts
new file mode 100644
index 0000000000000..589a93d160068
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/lens_attributes.ts
@@ -0,0 +1,273 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  CountIndexPatternColumn,
+  DateHistogramIndexPatternColumn,
+  LastValueIndexPatternColumn,
+  OperationType,
+  PersistedIndexPatternLayer,
+  RangeIndexPatternColumn,
+  SeriesType,
+  TypedLensByValueInput,
+  XYState,
+  XYCurveType,
+  DataType,
+} from '../../../../../../lens/public';
+import {
+  buildPhraseFilter,
+  buildPhrasesFilter,
+  IndexPattern,
+} from '../../../../../../../../src/plugins/data/common';
+import { FieldLabels } from './constants';
+import { DataSeries, UrlFilter } from '../types';
+
+function getLayerReferenceName(layerId: string) {
+  return `indexpattern-datasource-layer-${layerId}`;
+}
+
+export class LensAttributes {
+  indexPattern: IndexPattern;
+  layers: Record<string, PersistedIndexPatternLayer>;
+  visualization: XYState;
+  filters: UrlFilter[];
+  seriesType: SeriesType;
+  reportViewConfig: DataSeries;
+  reportDefinitions: Record<string, string>;
+
+  constructor(
+    indexPattern: IndexPattern,
+    reportViewConfig: DataSeries,
+    seriesType?: SeriesType,
+    filters?: UrlFilter[],
+    metricType?: OperationType,
+    reportDefinitions?: Record<string, string>
+  ) {
+    this.indexPattern = indexPattern;
+    this.layers = {};
+    this.filters = filters ?? [];
+    this.reportDefinitions = reportDefinitions ?? {};
+
+    if (typeof reportViewConfig.yAxisColumn.operationType !== undefined && metricType) {
+      reportViewConfig.yAxisColumn.operationType = metricType;
+    }
+    this.seriesType = seriesType ?? reportViewConfig.defaultSeriesType;
+    this.reportViewConfig = reportViewConfig;
+    this.layers.layer1 = this.getLayer();
+    this.visualization = this.getXyState();
+  }
+
+  addBreakdown(sourceField: string) {
+    const fieldMeta = this.indexPattern.getFieldByName(sourceField);
+
+    this.layers.layer1.columns['break-down-column'] = {
+      sourceField,
+      label: `Top values of ${FieldLabels[sourceField]}`,
+      dataType: fieldMeta?.type as DataType,
+      operationType: 'terms',
+      scale: 'ordinal',
+      isBucketed: true,
+      params: {
+        size: 3,
+        orderBy: { type: 'column', columnId: 'y-axis-column' },
+        orderDirection: 'desc',
+        otherBucket: true,
+        missingBucket: false,
+      },
+    };
+
+    this.layers.layer1.columnOrder = ['x-axis-column', 'break-down-column', 'y-axis-column'];
+
+    this.visualization.layers[0].splitAccessor = 'break-down-column';
+  }
+
+  removeBreakdown() {
+    delete this.layers.layer1.columns['break-down-column'];
+
+    this.layers.layer1.columnOrder = ['x-axis-column', 'y-axis-column'];
+
+    this.visualization.layers[0].splitAccessor = undefined;
+  }
+
+  getNumberColumn(sourceField: string): RangeIndexPatternColumn {
+    return {
+      sourceField,
+      label: this.reportViewConfig.labels[sourceField],
+      dataType: 'number',
+      operationType: 'range',
+      isBucketed: true,
+      scale: 'interval',
+      params: {
+        type: 'histogram',
+        ranges: [{ from: 0, to: 1000, label: '' }],
+        maxBars: 'auto',
+      },
+    };
+  }
+
+  getDateHistogramColumn(sourceField: string): DateHistogramIndexPatternColumn {
+    return {
+      sourceField,
+      dataType: 'date',
+      isBucketed: true,
+      label: '@timestamp',
+      operationType: 'date_histogram',
+      params: { interval: 'auto' },
+      scale: 'interval',
+    };
+  }
+
+  getXAxis():
+    | LastValueIndexPatternColumn
+    | DateHistogramIndexPatternColumn
+    | RangeIndexPatternColumn {
+    const { xAxisColumn } = this.reportViewConfig;
+
+    const { type: fieldType, name: fieldName } = this.getFieldMeta(xAxisColumn.sourceField)!;
+
+    if (fieldType === 'date') {
+      return this.getDateHistogramColumn(fieldName);
+    }
+    if (fieldType === 'number') {
+      return this.getNumberColumn(fieldName);
+    }
+
+    // FIXME review my approach again
+    return this.getDateHistogramColumn(fieldName);
+  }
+
+  getFieldMeta(sourceField?: string) {
+    let xAxisField = sourceField;
+
+    if (xAxisField) {
+      const rdf = this.reportViewConfig.reportDefinitions ?? [];
+
+      const customField = rdf.find(({ field }) => field === xAxisField);
+
+      if (customField) {
+        if (this.reportDefinitions[xAxisField]) {
+          xAxisField = this.reportDefinitions[xAxisField];
+        } else if (customField.defaultValue) {
+          xAxisField = customField.defaultValue;
+        } else if (customField.options?.[0].field) {
+          xAxisField = customField.options?.[0].field;
+        }
+      }
+
+      return this.indexPattern.getFieldByName(xAxisField);
+    }
+  }
+
+  getMainYAxis() {
+    return {
+      dataType: 'number',
+      isBucketed: false,
+      label: 'Count of records',
+      operationType: 'count',
+      scale: 'ratio',
+      sourceField: 'Records',
+      ...this.reportViewConfig.yAxisColumn,
+    } as CountIndexPatternColumn;
+  }
+
+  getLayer() {
+    return {
+      columnOrder: ['x-axis-column', 'y-axis-column'],
+      columns: {
+        'x-axis-column': this.getXAxis(),
+        'y-axis-column': this.getMainYAxis(),
+      },
+      incompleteColumns: {},
+    };
+  }
+
+  getXyState(): XYState {
+    return {
+      legend: { isVisible: true, position: 'right' },
+      valueLabels: 'hide',
+      fittingFunction: 'Linear',
+      curveType: 'CURVE_MONOTONE_X' as XYCurveType,
+      axisTitlesVisibilitySettings: { x: true, yLeft: true, yRight: true },
+      tickLabelsVisibilitySettings: { x: true, yLeft: true, yRight: true },
+      gridlinesVisibilitySettings: { x: true, yLeft: true, yRight: true },
+      preferredSeriesType: 'line',
+      layers: [
+        {
+          accessors: ['y-axis-column'],
+          layerId: 'layer1',
+          seriesType: this.seriesType ?? 'line',
+          palette: this.reportViewConfig.palette,
+          yConfig: [{ forAccessor: 'y-axis-column', color: 'green' }],
+          xAccessor: 'x-axis-column',
+        },
+      ],
+    };
+  }
+
+  parseFilters() {
+    const defaultFilters = this.reportViewConfig.filters ?? [];
+    const parsedFilters = this.reportViewConfig.filters ? [...defaultFilters] : [];
+
+    this.filters.forEach(({ field, values = [], notValues = [] }) => {
+      const fieldMeta = this.indexPattern.fields.find((fieldT) => fieldT.name === field)!;
+
+      if (values?.length > 0) {
+        if (values?.length > 1) {
+          const multiFilter = buildPhrasesFilter(fieldMeta, values, this.indexPattern);
+          parsedFilters.push(multiFilter);
+        } else {
+          const filter = buildPhraseFilter(fieldMeta, values[0], this.indexPattern);
+          parsedFilters.push(filter);
+        }
+      }
+
+      if (notValues?.length > 0) {
+        if (notValues?.length > 1) {
+          const multiFilter = buildPhrasesFilter(fieldMeta, notValues, this.indexPattern);
+          multiFilter.meta.negate = true;
+          parsedFilters.push(multiFilter);
+        } else {
+          const filter = buildPhraseFilter(fieldMeta, notValues[0], this.indexPattern);
+          filter.meta.negate = true;
+          parsedFilters.push(filter);
+        }
+      }
+    });
+
+    return parsedFilters;
+  }
+
+  getJSON(): TypedLensByValueInput['attributes'] {
+    return {
+      title: 'Prefilled from exploratory view app',
+      description: '',
+      visualizationType: 'lnsXY',
+      references: [
+        {
+          id: this.indexPattern.id!,
+          name: 'indexpattern-datasource-current-indexpattern',
+          type: 'index-pattern',
+        },
+        {
+          id: this.indexPattern.id!,
+          name: getLayerReferenceName('layer1'),
+          type: 'index-pattern',
+        },
+      ],
+      state: {
+        datasourceStates: {
+          indexpattern: {
+            layers: this.layers,
+          },
+        },
+        visualization: this.visualization,
+        query: { query: '', language: 'kuery' },
+        filters: this.parseFilters(),
+      },
+    };
+  }
+}
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/logs_frequency_config.ts b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/logs_frequency_config.ts
new file mode 100644
index 0000000000000..68e5e697d2f9d
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/logs_frequency_config.ts
@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { DataSeries } from '../types';
+import { FieldLabels } from './constants';
+
+interface Props {
+  seriesId: string;
+}
+
+export function getLogsFrequencyLensConfig({ seriesId }: Props): DataSeries {
+  return {
+    id: seriesId,
+    reportType: 'logs-frequency',
+    defaultSeriesType: 'line',
+    seriesTypes: ['line', 'bar'],
+    xAxisColumn: {
+      sourceField: '@timestamp',
+    },
+    yAxisColumn: {
+      operationType: 'count',
+    },
+    hasMetricType: false,
+    defaultFilters: [],
+    breakdowns: ['agent.hostname'],
+    filters: [],
+    labels: { ...FieldLabels },
+    reportDefinitions: [
+      {
+        field: 'agent.hostname',
+        required: true,
+      },
+    ],
+  };
+}
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/memory_usage_config.ts b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/memory_usage_config.ts
new file mode 100644
index 0000000000000..579372ed86fa7
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/memory_usage_config.ts
@@ -0,0 +1,42 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { DataSeries } from '../types';
+import { FieldLabels } from './constants';
+import { OperationType } from '../../../../../../lens/public';
+
+interface Props {
+  seriesId: string;
+}
+
+export function getMemoryUsageLensConfig({ seriesId }: Props): DataSeries {
+  return {
+    id: seriesId,
+    reportType: 'memory-usage',
+    defaultSeriesType: 'line',
+    seriesTypes: ['line', 'bar'],
+    xAxisColumn: {
+      sourceField: '@timestamp',
+    },
+    yAxisColumn: {
+      operationType: 'avg' as OperationType,
+      sourceField: 'system.memory.used.pct',
+      label: 'Memory Usage %',
+    },
+    hasMetricType: true,
+    defaultFilters: [],
+    breakdowns: ['host.hostname'],
+    filters: [],
+    labels: { ...FieldLabels, 'host.hostname': 'Host name' },
+    reportDefinitions: [
+      {
+        field: 'host.hostname',
+        required: true,
+      },
+    ],
+  };
+}
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/monitor_duration_config.ts b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/monitor_duration_config.ts
new file mode 100644
index 0000000000000..aa9b8b94c6d86
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/monitor_duration_config.ts
@@ -0,0 +1,48 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { DataSeries } from '../types';
+import { FieldLabels } from './constants';
+import { OperationType } from '../../../../../../lens/public';
+
+interface Props {
+  seriesId: string;
+}
+
+export function getMonitorDurationConfig({ seriesId }: Props): DataSeries {
+  return {
+    id: seriesId,
+    reportType: 'uptime-duration',
+    defaultSeriesType: 'line',
+    seriesTypes: ['line', 'bar_stacked'],
+    xAxisColumn: {
+      sourceField: '@timestamp',
+    },
+    yAxisColumn: {
+      operationType: 'avg' as OperationType,
+      sourceField: 'monitor.duration.us',
+      label: 'Monitor duration (ms)',
+    },
+    hasMetricType: true,
+    defaultFilters: ['monitor.type', 'observer.geo.name', 'tags'],
+    breakdowns: [
+      'observer.geo.name',
+      'monitor.name',
+      'monitor.id',
+      'monitor.type',
+      'tags',
+      'url.port',
+    ],
+    filters: [],
+    reportDefinitions: [
+      {
+        field: 'monitor.id',
+      },
+    ],
+    labels: { ...FieldLabels },
+  };
+}
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/monitor_pings_config.ts b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/monitor_pings_config.ts
new file mode 100644
index 0000000000000..72968626e934b
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/monitor_pings_config.ts
@@ -0,0 +1,43 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { DataSeries } from '../types';
+import { FieldLabels } from './constants';
+
+interface Props {
+  seriesId: string;
+}
+
+export function getMonitorPingsConfig({ seriesId }: Props): DataSeries {
+  return {
+    id: seriesId,
+    reportType: 'uptime-pings',
+    defaultSeriesType: 'bar_stacked',
+    seriesTypes: ['bar_stacked', 'bar'],
+    xAxisColumn: {
+      sourceField: '@timestamp',
+    },
+    yAxisColumn: {
+      operationType: 'count',
+      label: 'Monitor pings',
+    },
+    hasMetricType: false,
+    defaultFilters: ['observer.geo.name'],
+    breakdowns: ['monitor.status', 'observer.geo.name', 'monitor.type'],
+    filters: [],
+    palette: { type: 'palette', name: 'status' },
+    reportDefinitions: [
+      {
+        field: 'monitor.id',
+      },
+      {
+        field: 'url.full',
+      },
+    ],
+    labels: { ...FieldLabels },
+  };
+}
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/network_activity_config.ts b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/network_activity_config.ts
new file mode 100644
index 0000000000000..63cdd0ec8bd60
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/network_activity_config.ts
@@ -0,0 +1,41 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { DataSeries } from '../types';
+import { FieldLabels } from './constants';
+import { OperationType } from '../../../../../../lens/public';
+
+interface Props {
+  seriesId: string;
+}
+
+export function getNetworkActivityLensConfig({ seriesId }: Props): DataSeries {
+  return {
+    id: seriesId,
+    reportType: 'network-activity',
+    defaultSeriesType: 'line',
+    seriesTypes: ['line', 'bar'],
+    xAxisColumn: {
+      sourceField: '@timestamp',
+    },
+    yAxisColumn: {
+      operationType: 'avg' as OperationType,
+      sourceField: 'system.memory.used.pct',
+    },
+    hasMetricType: true,
+    defaultFilters: [],
+    breakdowns: ['host.hostname'],
+    filters: [],
+    labels: { ...FieldLabels, 'host.hostname': 'Host name' },
+    reportDefinitions: [
+      {
+        field: 'host.hostname',
+        required: true,
+      },
+    ],
+  };
+}
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/performance_dist_config.ts b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/performance_dist_config.ts
new file mode 100644
index 0000000000000..41617304c9f3d
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/performance_dist_config.ts
@@ -0,0 +1,86 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ConfigProps, DataSeries } from '../types';
+import { FieldLabels } from './constants';
+import { buildPhraseFilter } from './utils';
+import {
+  CLIENT_GEO_COUNTRY_NAME,
+  CLS_FIELD,
+  FCP_FIELD,
+  FID_FIELD,
+  LCP_FIELD,
+  PROCESSOR_EVENT,
+  SERVICE_ENVIRONMENT,
+  SERVICE_NAME,
+  TBT_FIELD,
+  TRANSACTION_DURATION,
+  TRANSACTION_TYPE,
+  USER_AGENT_DEVICE,
+  USER_AGENT_NAME,
+  USER_AGENT_OS,
+  USER_AGENT_VERSION,
+} from './data/elasticsearch_fieldnames';
+
+export function getPerformanceDistLensConfig({ seriesId, indexPattern }: ConfigProps): DataSeries {
+  return {
+    id: seriesId ?? 'unique-key',
+    reportType: 'page-load-dist',
+    defaultSeriesType: 'line',
+    seriesTypes: ['line', 'bar'],
+    xAxisColumn: {
+      sourceField: 'performance.metric',
+    },
+    yAxisColumn: {
+      operationType: 'count',
+      label: 'Pages loaded',
+    },
+    hasMetricType: false,
+    defaultFilters: [
+      USER_AGENT_OS,
+      CLIENT_GEO_COUNTRY_NAME,
+      USER_AGENT_DEVICE,
+      {
+        field: USER_AGENT_NAME,
+        nested: USER_AGENT_VERSION,
+      },
+    ],
+    breakdowns: [USER_AGENT_NAME, USER_AGENT_OS, CLIENT_GEO_COUNTRY_NAME, USER_AGENT_DEVICE],
+    reportDefinitions: [
+      {
+        field: SERVICE_NAME,
+        required: true,
+      },
+      {
+        field: SERVICE_ENVIRONMENT,
+      },
+      {
+        field: 'performance.metric',
+        custom: true,
+        defaultValue: TRANSACTION_DURATION,
+        options: [
+          { label: 'Page load time', field: TRANSACTION_DURATION },
+          { label: 'First contentful paint', field: FCP_FIELD },
+          { label: 'Total blocking time', field: TBT_FIELD },
+          // FIXME, review if we need these descriptions
+          { label: 'Largest contentful paint', field: LCP_FIELD, description: 'Core web vital' },
+          { label: 'First input delay', field: FID_FIELD, description: 'Core web vital' },
+          { label: 'Cumulative layout shift', field: CLS_FIELD, description: 'Core web vital' },
+        ],
+      },
+    ],
+    filters: [
+      buildPhraseFilter(TRANSACTION_TYPE, 'page-load', indexPattern),
+      buildPhraseFilter(PROCESSOR_EVENT, 'transaction', indexPattern),
+    ],
+    labels: {
+      ...FieldLabels,
+      [SERVICE_NAME]: 'Web Application',
+      [TRANSACTION_DURATION]: 'Page load time',
+    },
+  };
+}
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/service_latency_config.ts b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/service_latency_config.ts
new file mode 100644
index 0000000000000..a31679c61a4ab
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/service_latency_config.ts
@@ -0,0 +1,52 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ConfigProps, DataSeries } from '../types';
+import { FieldLabels } from './constants';
+import { buildPhraseFilter } from './utils';
+import { OperationType } from '../../../../../../lens/public';
+
+export function getServiceLatencyLensConfig({ seriesId, indexPattern }: ConfigProps): DataSeries {
+  return {
+    id: seriesId,
+    reportType: 'service-latency',
+    defaultSeriesType: 'line',
+    seriesTypes: ['line', 'bar'],
+    xAxisColumn: {
+      sourceField: '@timestamp',
+    },
+    yAxisColumn: {
+      operationType: 'avg' as OperationType,
+      sourceField: 'transaction.duration.us',
+      label: 'Latency',
+    },
+    hasMetricType: true,
+    defaultFilters: [
+      'user_agent.name',
+      'user_agent.os.name',
+      'client.geo.country_name',
+      'user_agent.device.name',
+    ],
+    breakdowns: [
+      'user_agent.name',
+      'user_agent.os.name',
+      'client.geo.country_name',
+      'user_agent.device.name',
+    ],
+    filters: [buildPhraseFilter('transaction.type', 'request', indexPattern)],
+    labels: { ...FieldLabels },
+    reportDefinitions: [
+      {
+        field: 'service.name',
+        required: true,
+      },
+      {
+        field: 'service.environment',
+      },
+    ],
+  };
+}
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/service_throughput_config.ts b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/service_throughput_config.ts
new file mode 100644
index 0000000000000..32cae2167ddf0
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/service_throughput_config.ts
@@ -0,0 +1,55 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ConfigProps, DataSeries } from '../types';
+import { FieldLabels } from './constants';
+import { buildPhraseFilter } from './utils';
+import { OperationType } from '../../../../../../lens/public';
+
+export function getServiceThroughputLensConfig({
+  seriesId,
+  indexPattern,
+}: ConfigProps): DataSeries {
+  return {
+    id: seriesId,
+    reportType: 'service-latency',
+    defaultSeriesType: 'line',
+    seriesTypes: ['line', 'bar'],
+    xAxisColumn: {
+      sourceField: '@timestamp',
+    },
+    yAxisColumn: {
+      operationType: 'avg' as OperationType,
+      sourceField: 'transaction.duration.us',
+      label: 'Throughput',
+    },
+    hasMetricType: true,
+    defaultFilters: [
+      'user_agent.name',
+      'user_agent.os.name',
+      'client.geo.country_name',
+      'user_agent.device.name',
+    ],
+    breakdowns: [
+      'user_agent.name',
+      'user_agent.os.name',
+      'client.geo.country_name',
+      'user_agent.device.name',
+    ],
+    filters: [buildPhraseFilter('transaction.type', 'request', indexPattern)],
+    labels: { ...FieldLabels },
+    reportDefinitions: [
+      {
+        field: 'service.name',
+        required: true,
+      },
+      {
+        field: 'service.environment',
+      },
+    ],
+  };
+}
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/url_constants.ts b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/url_constants.ts
new file mode 100644
index 0000000000000..5b99c19dbabb7
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/url_constants.ts
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export enum URL_KEYS {
+  METRIC_TYPE = 'mt',
+  REPORT_TYPE = 'rt',
+  SERIES_TYPE = 'st',
+  BREAK_DOWN = 'bd',
+  FILTERS = 'ft',
+  REPORT_DEFINITIONS = 'rdf',
+}
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/utils.ts b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/utils.ts
new file mode 100644
index 0000000000000..38b8ce81b2acd
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/utils.ts
@@ -0,0 +1,54 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import rison, { RisonValue } from 'rison-node';
+import type { AllSeries, AllShortSeries } from '../hooks/use_url_strorage';
+import type { SeriesUrl } from '../types';
+import { IIndexPattern } from '../../../../../../../../src/plugins/data/common/index_patterns';
+import { esFilters } from '../../../../../../../../src/plugins/data/public';
+import { URL_KEYS } from './url_constants';
+
+export function convertToShortUrl(series: SeriesUrl) {
+  const {
+    metric,
+    seriesType,
+    reportType,
+    breakdown,
+    filters,
+    reportDefinitions,
+    ...restSeries
+  } = series;
+
+  return {
+    [URL_KEYS.METRIC_TYPE]: metric,
+    [URL_KEYS.REPORT_TYPE]: reportType,
+    [URL_KEYS.SERIES_TYPE]: seriesType,
+    [URL_KEYS.BREAK_DOWN]: breakdown,
+    [URL_KEYS.FILTERS]: filters,
+    [URL_KEYS.REPORT_DEFINITIONS]: reportDefinitions,
+    ...restSeries,
+  };
+}
+
+export function createExploratoryViewUrl(allSeries: AllSeries, baseHref = '') {
+  const allSeriesIds = Object.keys(allSeries);
+
+  const allShortSeries: AllShortSeries = {};
+
+  allSeriesIds.forEach((seriesKey) => {
+    allShortSeries[seriesKey] = convertToShortUrl(allSeries[seriesKey]);
+  });
+
+  return (
+    baseHref +
+    `/app/observability/exploratory-view#?sr=${rison.encode(allShortSeries as RisonValue)}`
+  );
+}
+
+export function buildPhraseFilter(field: string, value: any, indexPattern: IIndexPattern) {
+  const fieldMeta = indexPattern.fields.find((fieldT) => fieldT.name === field)!;
+  return esFilters.buildPhraseFilter(fieldMeta, value, indexPattern);
+}
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/exploratory_view.test.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/exploratory_view.test.tsx
new file mode 100644
index 0000000000000..7e99874f557b3
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/exploratory_view.test.tsx
@@ -0,0 +1,93 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { within } from '@testing-library/react';
+import { fireEvent, screen, waitFor } from '@testing-library/dom';
+import { render, mockUrlStorage, mockCore } from './rtl_helpers';
+import { ExploratoryView } from './exploratory_view';
+import { getStubIndexPattern } from '../../../../../../../src/plugins/data/public/test_utils';
+import * as obsvInd from '../../../utils/observability_index_patterns';
+
+describe('ExploratoryView', () => {
+  beforeEach(() => {
+    const indexPattern = getStubIndexPattern(
+      'apm-*',
+      () => {},
+      '@timestamp',
+      [
+        {
+          name: '@timestamp',
+          type: 'date',
+          esTypes: ['date'],
+          searchable: true,
+          aggregatable: true,
+          readFromDocValues: true,
+        },
+      ],
+      mockCore() as any
+    );
+
+    jest.spyOn(obsvInd, 'ObservabilityIndexPatterns').mockReturnValue({
+      getIndexPattern: jest.fn().mockReturnValue(indexPattern),
+    } as any);
+  });
+
+  it('renders exploratory view', async () => {
+    render(<ExploratoryView />);
+
+    await waitFor(() => {
+      screen.getByText(/open in lens/i);
+      screen.getByRole('heading', { name: /exploratory view/i });
+      screen.getByRole('img', { name: /visulization/i });
+      screen.getByText(/add series/i);
+      screen.getByText(/no series found, please add a series\./i);
+    });
+  });
+
+  it('can add, cancel new series', async () => {
+    render(<ExploratoryView />);
+
+    await fireEvent.click(screen.getByText(/add series/i));
+
+    await waitFor(() => {
+      screen.getByText(/open in lens/i);
+      screen.getByText(/select a data type to start building a series\./i);
+      screen.getByRole('table', { name: /this table contains 1 rows\./i });
+      const button = screen.getByRole('button', { name: /add/i });
+      within(button).getByText(/add/i);
+    });
+
+    await fireEvent.click(screen.getByText(/cancel/i));
+
+    await waitFor(() => {
+      screen.getByText(/add series/i);
+    });
+  });
+
+  it('renders lens component when there is series', async () => {
+    mockUrlStorage({
+      data: {
+        'uptime-pings-histogram': {
+          reportType: 'upp',
+          breakdown: 'monitor.status',
+          time: { from: 'now-15m', to: 'now' },
+        },
+      },
+    });
+
+    render(<ExploratoryView />);
+
+    await waitFor(() => {
+      screen.getByText(/open in lens/i);
+      screen.getByRole('heading', { name: /uptime pings/i });
+      screen.getByText(/uptime-pings-histogram/i);
+      screen.getByText(/Lens Embeddable Component/i);
+      screen.getByRole('table', { name: /this table contains 1 rows\./i });
+    });
+  });
+});
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/exploratory_view.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/exploratory_view.tsx
new file mode 100644
index 0000000000000..b3ad107bbe0e2
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/exploratory_view.tsx
@@ -0,0 +1,87 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { i18n } from '@kbn/i18n';
+import React, { useEffect, useState } from 'react';
+import styled from 'styled-components';
+import { EuiLoadingSpinner, EuiPanel, EuiTitle } from '@elastic/eui';
+import { useKibana } from '../../../../../../../src/plugins/kibana_react/public';
+import { ObservabilityPublicPluginsStart } from '../../../plugin';
+import { ExploratoryViewHeader } from './header/header';
+import { SeriesEditor } from './series_editor/series_editor';
+import { useUrlStorage } from './hooks/use_url_strorage';
+import { useLensAttributes } from './hooks/use_lens_attributes';
+import { EmptyView } from './components/empty_view';
+import { useIndexPatternContext } from './hooks/use_default_index_pattern';
+import { TypedLensByValueInput } from '../../../../../lens/public';
+
+export function ExploratoryView() {
+  const {
+    services: { lens },
+  } = useKibana<ObservabilityPublicPluginsStart>();
+
+  const [lensAttributes, setLensAttributes] = useState<TypedLensByValueInput['attributes'] | null>(
+    null
+  );
+
+  const { indexPattern } = useIndexPatternContext();
+
+  const LensComponent = lens?.EmbeddableComponent;
+
+  const { firstSeriesId: seriesId, firstSeries: series } = useUrlStorage();
+
+  const lensAttributesT = useLensAttributes({
+    seriesId,
+    indexPattern,
+  });
+
+  useEffect(() => {
+    setLensAttributes(lensAttributesT);
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [JSON.stringify(lensAttributesT ?? {}), series?.reportType, series?.time?.from]);
+
+  return (
+    <EuiPanel style={{ maxWidth: 1800, minWidth: 1200, margin: '0 auto' }}>
+      {lens ? (
+        <>
+          <ExploratoryViewHeader lensAttributes={lensAttributes} seriesId={seriesId} />
+          {!indexPattern && (
+            <SpinnerWrap>
+              <EuiLoadingSpinner size="xl" />
+            </SpinnerWrap>
+          )}
+          {lensAttributes && seriesId && series?.reportType && series?.time ? (
+            <LensComponent
+              id="exploratoryView"
+              style={{ height: 550 }}
+              timeRange={series?.time}
+              attributes={lensAttributes}
+            />
+          ) : (
+            <EmptyView />
+          )}
+          <SeriesEditor />
+        </>
+      ) : (
+        <EuiTitle>
+          <h2>
+            {i18n.translate('xpack.observability.overview.exploratoryView.lensDisabled', {
+              defaultMessage:
+                'Lens app is not available, please enable Lens to use exploratory view.',
+            })}
+          </h2>
+        </EuiTitle>
+      )}
+    </EuiPanel>
+  );
+}
+
+const SpinnerWrap = styled.div`
+  height: 100vh;
+  display: flex;
+  justify-content: center;
+  align-items: center;
+`;
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/header/header.test.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/header/header.test.tsx
new file mode 100644
index 0000000000000..de6912f256be7
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/header/header.test.tsx
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { mockUrlStorage, render } from '../rtl_helpers';
+import { ExploratoryViewHeader } from './header';
+import { fireEvent } from '@testing-library/dom';
+
+describe('ExploratoryViewHeader', function () {
+  it('should render properly', function () {
+    const { getByText } = render(
+      <ExploratoryViewHeader
+        seriesId={'dummy-series'}
+        lensAttributes={{ title: 'Performance distribution' } as any}
+      />
+    );
+    getByText('Open in Lens');
+  });
+
+  it('should be able to click open in lens', function () {
+    mockUrlStorage({
+      data: {
+        'uptime-pings-histogram': {
+          reportType: 'upp',
+          breakdown: 'monitor.status',
+          time: { from: 'now-15m', to: 'now' },
+        },
+      },
+    });
+
+    const { getByText, core } = render(
+      <ExploratoryViewHeader
+        seriesId={'dummy-series'}
+        lensAttributes={{ title: 'Performance distribution' } as any}
+      />
+    );
+    fireEvent.click(getByText('Open in Lens'));
+
+    expect(core?.lens?.navigateToPrefilledEditor).toHaveBeenCalledTimes(1);
+    expect(core?.lens?.navigateToPrefilledEditor).toHaveBeenCalledWith({
+      attributes: { title: 'Performance distribution' },
+      id: '',
+      timeRange: {
+        from: 'now-15m',
+        to: 'now',
+      },
+    });
+  });
+});
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/header/header.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/header/header.tsx
new file mode 100644
index 0000000000000..bda3566c76602
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/header/header.tsx
@@ -0,0 +1,63 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { i18n } from '@kbn/i18n';
+import { EuiButton, EuiFlexGroup, EuiFlexItem, EuiText } from '@elastic/eui';
+import { TypedLensByValueInput } from '../../../../../../lens/public';
+import { useKibana } from '../../../../../../../../src/plugins/kibana_react/public';
+import { ObservabilityPublicPluginsStart } from '../../../../plugin';
+import { DataViewLabels } from '../configurations/constants';
+import { useUrlStorage } from '../hooks/use_url_strorage';
+
+interface Props {
+  seriesId: string;
+  lensAttributes: TypedLensByValueInput['attributes'] | null;
+}
+
+export function ExploratoryViewHeader({ seriesId, lensAttributes }: Props) {
+  const {
+    services: { lens },
+  } = useKibana<ObservabilityPublicPluginsStart>();
+
+  const { series } = useUrlStorage(seriesId);
+
+  return (
+    <EuiFlexGroup justifyContent="spaceBetween" alignItems="center">
+      <EuiFlexItem>
+        <EuiText>
+          <h2>
+            {DataViewLabels[series.reportType] ??
+              i18n.translate('xpack.observability.expView.heading.label', {
+                defaultMessage: 'Exploratory view',
+              })}
+          </h2>
+        </EuiText>
+      </EuiFlexItem>
+      <EuiFlexItem grow={false}>
+        <EuiButton
+          iconType="lensApp"
+          fullWidth={false}
+          isDisabled={!lens.canUseEditor() || lensAttributes === null}
+          onClick={() => {
+            if (lensAttributes) {
+              lens.navigateToPrefilledEditor({
+                id: '',
+                timeRange: series.time,
+                attributes: lensAttributes,
+              });
+            }
+          }}
+        >
+          {i18n.translate('xpack.observability.expView.heading.openInLens', {
+            defaultMessage: 'Open in Lens',
+          })}
+        </EuiButton>
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  );
+}
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/hooks/use_default_index_pattern.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/hooks/use_default_index_pattern.tsx
new file mode 100644
index 0000000000000..04cbb4a4ddb18
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/hooks/use_default_index_pattern.tsx
@@ -0,0 +1,61 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { createContext, useContext, Context, useState, useEffect } from 'react';
+import { IndexPattern } from '../../../../../../../../src/plugins/data/common';
+import { AppDataType } from '../types';
+import { useKibana } from '../../../../../../../../src/plugins/kibana_react/public';
+import { ObservabilityPublicPluginsStart } from '../../../../plugin';
+import { ObservabilityIndexPatterns } from '../../../../utils/observability_index_patterns';
+
+export interface IIndexPatternContext {
+  indexPattern: IndexPattern;
+  loadIndexPattern: (dataType: AppDataType) => void;
+}
+
+export const IndexPatternContext = createContext<Partial<IIndexPatternContext>>({});
+
+interface ProviderProps {
+  indexPattern?: IndexPattern;
+  children: JSX.Element;
+}
+
+export function IndexPatternContextProvider({
+  children,
+  indexPattern: initialIndexPattern,
+}: ProviderProps) {
+  const [indexPattern, setIndexPattern] = useState(initialIndexPattern);
+
+  useEffect(() => {
+    setIndexPattern(initialIndexPattern);
+  }, [initialIndexPattern]);
+
+  const {
+    services: { data },
+  } = useKibana<ObservabilityPublicPluginsStart>();
+
+  const loadIndexPattern = async (dataType: AppDataType) => {
+    const obsvIndexP = new ObservabilityIndexPatterns(data);
+    const indPattern = await obsvIndexP.getIndexPattern(dataType);
+    setIndexPattern(indPattern!);
+  };
+
+  return (
+    <IndexPatternContext.Provider
+      value={{
+        indexPattern,
+        loadIndexPattern,
+      }}
+    >
+      {children}
+    </IndexPatternContext.Provider>
+  );
+}
+
+export const useIndexPatternContext = () => {
+  return useContext((IndexPatternContext as unknown) as Context<IIndexPatternContext>);
+};
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/hooks/use_init_exploratory_view.ts b/x-pack/plugins/observability/public/components/shared/exploratory_view/hooks/use_init_exploratory_view.ts
new file mode 100644
index 0000000000000..9f462790e8d37
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/hooks/use_init_exploratory_view.ts
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { useFetcher } from '../../../..';
+import { IKbnUrlStateStorage } from '../../../../../../../../src/plugins/kibana_utils/public';
+import { useKibana } from '../../../../../../../../src/plugins/kibana_react/public';
+import { ObservabilityPublicPluginsStart } from '../../../../plugin';
+import { AllShortSeries } from './use_url_strorage';
+import { ReportToDataTypeMap } from '../configurations/constants';
+import {
+  DataType,
+  ObservabilityIndexPatterns,
+} from '../../../../utils/observability_index_patterns';
+
+export const useInitExploratoryView = (storage: IKbnUrlStateStorage) => {
+  const {
+    services: { data },
+  } = useKibana<ObservabilityPublicPluginsStart>();
+
+  const allSeriesKey = 'sr';
+
+  const allSeries = storage.get<AllShortSeries>(allSeriesKey) ?? {};
+
+  const allSeriesIds = Object.keys(allSeries);
+
+  const firstSeriesId = allSeriesIds?.[0];
+
+  const firstSeries = allSeries[firstSeriesId];
+
+  const { data: indexPattern } = useFetcher(() => {
+    const obsvIndexP = new ObservabilityIndexPatterns(data);
+    let reportType: DataType = 'apm';
+    if (firstSeries?.rt) {
+      reportType = ReportToDataTypeMap[firstSeries?.rt];
+    }
+
+    return obsvIndexP.getIndexPattern(reportType);
+  }, [firstSeries?.rt, data]);
+
+  return indexPattern;
+};
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/hooks/use_lens_attributes.ts b/x-pack/plugins/observability/public/components/shared/exploratory_view/hooks/use_lens_attributes.ts
new file mode 100644
index 0000000000000..1c735009f66f9
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/hooks/use_lens_attributes.ts
@@ -0,0 +1,88 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useMemo } from 'react';
+import { TypedLensByValueInput } from '../../../../../../lens/public';
+import { LensAttributes } from '../configurations/lens_attributes';
+import { useUrlStorage } from './use_url_strorage';
+import { getDefaultConfigs } from '../configurations/default_configs';
+
+import { IndexPattern } from '../../../../../../../../src/plugins/data/common';
+import { DataSeries, SeriesUrl, UrlFilter } from '../types';
+
+interface Props {
+  seriesId: string;
+  indexPattern?: IndexPattern | null;
+}
+
+export const getFiltersFromDefs = (
+  reportDefinitions: SeriesUrl['reportDefinitions'],
+  dataViewConfig: DataSeries
+) => {
+  const rdfFilters = Object.entries(reportDefinitions ?? {}).map(([field, value]) => {
+    return {
+      field,
+      values: [value],
+    };
+  }) as UrlFilter[];
+
+  // let's filter out custom fields
+  return rdfFilters.filter(({ field }) => {
+    const rdf = dataViewConfig.reportDefinitions.find(({ field: fd }) => field === fd);
+    return !rdf?.custom;
+  });
+};
+
+export const useLensAttributes = ({
+  seriesId,
+  indexPattern,
+}: Props): TypedLensByValueInput['attributes'] | null => {
+  const { series } = useUrlStorage(seriesId);
+
+  const { breakdown, seriesType, metric: metricType, reportType, reportDefinitions = {} } =
+    series ?? {};
+
+  return useMemo(() => {
+    if (!indexPattern || !reportType) {
+      return null;
+    }
+
+    const dataViewConfig = getDefaultConfigs({
+      seriesId,
+      reportType,
+      indexPattern,
+    });
+
+    const filters: UrlFilter[] = (series.filters ?? []).concat(
+      getFiltersFromDefs(reportDefinitions, dataViewConfig)
+    );
+
+    const lensAttributes = new LensAttributes(
+      indexPattern,
+      dataViewConfig,
+      seriesType,
+      filters,
+      metricType,
+      reportDefinitions
+    );
+
+    if (breakdown) {
+      lensAttributes.addBreakdown(breakdown);
+    }
+
+    return lensAttributes.getJSON();
+  }, [
+    indexPattern,
+    breakdown,
+    seriesType,
+    metricType,
+    reportType,
+    reportDefinitions,
+    seriesId,
+    series.filters,
+  ]);
+};
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/hooks/use_series_filters.ts b/x-pack/plugins/observability/public/components/shared/exploratory_view/hooks/use_series_filters.ts
new file mode 100644
index 0000000000000..35247180c2ee5
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/hooks/use_series_filters.ts
@@ -0,0 +1,100 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useUrlStorage } from './use_url_strorage';
+import { UrlFilter } from '../types';
+
+export interface UpdateFilter {
+  field: string;
+  value: string;
+  negate?: boolean;
+}
+
+export const useSeriesFilters = ({ seriesId }: { seriesId: string }) => {
+  const { series, setSeries } = useUrlStorage(seriesId);
+
+  const filters = series.filters ?? [];
+
+  const removeFilter = ({ field, value, negate }: UpdateFilter) => {
+    const filtersN = filters.map((filter) => {
+      if (filter.field === field) {
+        if (negate) {
+          const notValuesN = filter.notValues?.filter((val) => val !== value);
+          return { ...filter, notValues: notValuesN };
+        } else {
+          const valuesN = filter.values?.filter((val) => val !== value);
+          return { ...filter, values: valuesN };
+        }
+      }
+
+      return filter;
+    });
+    setSeries(seriesId, { ...series, filters: filtersN });
+  };
+
+  const addFilter = ({ field, value, negate }: UpdateFilter) => {
+    const currFilter: UrlFilter = { field };
+    if (negate) {
+      currFilter.notValues = [value];
+    } else {
+      currFilter.values = [value];
+    }
+    if (filters.length === 0) {
+      setSeries(seriesId, { ...series, filters: [currFilter] });
+    } else {
+      setSeries(seriesId, {
+        ...series,
+        filters: [currFilter, ...filters.filter((ft) => ft.field !== field)],
+      });
+    }
+  };
+
+  const updateFilter = ({ field, value, negate }: UpdateFilter) => {
+    const currFilter: UrlFilter | undefined = filters.find(({ field: fd }) => field === fd) ?? {
+      field,
+    };
+
+    const currNotValues = currFilter.notValues ?? [];
+    const currValues = currFilter.values ?? [];
+
+    const notValues = currNotValues.filter((val) => val !== value);
+    const values = currValues.filter((val) => val !== value);
+
+    if (negate) {
+      notValues.push(value);
+    } else {
+      values.push(value);
+    }
+
+    currFilter.notValues = notValues.length > 0 ? notValues : undefined;
+    currFilter.values = values.length > 0 ? values : undefined;
+
+    const otherFilters = filters.filter(({ field: fd }) => fd !== field);
+
+    if (notValues.length > 0 || values.length > 0) {
+      setSeries(seriesId, { ...series, filters: [...otherFilters, currFilter] });
+    } else {
+      setSeries(seriesId, { ...series, filters: otherFilters });
+    }
+  };
+
+  const setFilter = ({ field, value, negate }: UpdateFilter) => {
+    const currFilter: UrlFilter | undefined = filters.find(({ field: fd }) => field === fd);
+
+    if (!currFilter) {
+      addFilter({ field, value, negate });
+    } else {
+      updateFilter({ field, value, negate });
+    }
+  };
+
+  const invertFilter = ({ field, value, negate }: UpdateFilter) => {
+    updateFilter({ field, value, negate: !negate });
+  };
+
+  return { invertFilter, setFilter, removeFilter };
+};
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/hooks/use_url_strorage.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/hooks/use_url_strorage.tsx
new file mode 100644
index 0000000000000..d38429703b709
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/hooks/use_url_strorage.tsx
@@ -0,0 +1,103 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { createContext, useContext, Context } from 'react';
+import { IKbnUrlStateStorage } from '../../../../../../../../src/plugins/kibana_utils/public';
+import type { AppDataType, ReportViewTypeId, SeriesUrl, UrlFilter } from '../types';
+import { convertToShortUrl } from '../configurations/utils';
+import { OperationType, SeriesType } from '../../../../../../lens/public';
+import { URL_KEYS } from '../configurations/url_constants';
+
+export const UrlStorageContext = createContext<IKbnUrlStateStorage | null>(null);
+
+interface ProviderProps {
+  storage: IKbnUrlStateStorage;
+}
+
+export function UrlStorageContextProvider({
+  children,
+  storage,
+}: ProviderProps & { children: JSX.Element }) {
+  return <UrlStorageContext.Provider value={storage}>{children}</UrlStorageContext.Provider>;
+}
+
+function convertFromShortUrl(newValue: ShortUrlSeries): SeriesUrl {
+  const { mt, st, rt, bd, ft, time, rdf, ...restSeries } = newValue;
+  return {
+    metric: mt,
+    reportType: rt!,
+    seriesType: st,
+    breakdown: bd,
+    filters: ft!,
+    time: time!,
+    reportDefinitions: rdf,
+    ...restSeries,
+  };
+}
+
+interface ShortUrlSeries {
+  [URL_KEYS.METRIC_TYPE]?: OperationType;
+  [URL_KEYS.REPORT_TYPE]?: ReportViewTypeId;
+  [URL_KEYS.SERIES_TYPE]?: SeriesType;
+  [URL_KEYS.BREAK_DOWN]?: string;
+  [URL_KEYS.FILTERS]?: UrlFilter[];
+  [URL_KEYS.REPORT_DEFINITIONS]?: Record<string, string>;
+  time?: {
+    to: string;
+    from: string;
+  };
+  dataType?: AppDataType;
+}
+
+export type AllShortSeries = Record<string, ShortUrlSeries>;
+export type AllSeries = Record<string, SeriesUrl>;
+
+export const NEW_SERIES_KEY = 'newSeriesKey';
+
+export function useUrlStorage(seriesId?: string) {
+  const allSeriesKey = 'sr';
+  const storage = useContext((UrlStorageContext as unknown) as Context<IKbnUrlStateStorage>);
+  let series: SeriesUrl = {} as SeriesUrl;
+  const allShortSeries = storage.get<AllShortSeries>(allSeriesKey) ?? {};
+
+  const allSeriesIds = Object.keys(allShortSeries);
+
+  const allSeries: AllSeries = {};
+
+  allSeriesIds.forEach((seriesKey) => {
+    allSeries[seriesKey] = convertFromShortUrl(allShortSeries[seriesKey]);
+  });
+
+  if (seriesId) {
+    series = allSeries?.[seriesId] ?? ({} as SeriesUrl);
+  }
+
+  const setSeries = async (seriesIdN: string, newValue: SeriesUrl) => {
+    allShortSeries[seriesIdN] = convertToShortUrl(newValue);
+    allSeries[seriesIdN] = newValue;
+    return storage.set(allSeriesKey, allShortSeries);
+  };
+
+  const removeSeries = (seriesIdN: string) => {
+    delete allShortSeries[seriesIdN];
+    delete allSeries[seriesIdN];
+    storage.set(allSeriesKey, allShortSeries);
+  };
+
+  const firstSeriesId = allSeriesIds?.[0];
+
+  return {
+    storage,
+    setSeries,
+    removeSeries,
+    series,
+    firstSeriesId,
+    allSeries,
+    allSeriesIds,
+    firstSeries: allSeries?.[firstSeriesId],
+  };
+}
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/index.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/index.tsx
new file mode 100644
index 0000000000000..dc47a0f075fe6
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/index.tsx
@@ -0,0 +1,64 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useContext } from 'react';
+import { i18n } from '@kbn/i18n';
+import { useHistory } from 'react-router-dom';
+import { ThemeContext } from 'styled-components';
+import { ExploratoryView } from './exploratory_view';
+import { useKibana } from '../../../../../../../src/plugins/kibana_react/public';
+import { ObservabilityPublicPluginsStart } from '../../../plugin';
+import { useBreadcrumbs } from '../../../hooks/use_breadcrumbs';
+import { IndexPatternContextProvider } from './hooks/use_default_index_pattern';
+import {
+  createKbnUrlStateStorage,
+  withNotifyOnErrors,
+} from '../../../../../../../src/plugins/kibana_utils/public/';
+import { UrlStorageContextProvider } from './hooks/use_url_strorage';
+import { useInitExploratoryView } from './hooks/use_init_exploratory_view';
+import { WithHeaderLayout } from '../../app/layout/with_header';
+
+export function ExploratoryViewPage() {
+  useBreadcrumbs([
+    {
+      text: i18n.translate('xpack.observability.overview.exploratoryView', {
+        defaultMessage: 'Exploratory view',
+      }),
+    },
+  ]);
+
+  const theme = useContext(ThemeContext);
+
+  const {
+    services: { uiSettings, notifications },
+  } = useKibana<ObservabilityPublicPluginsStart>();
+
+  const history = useHistory();
+
+  const kbnUrlStateStorage = createKbnUrlStateStorage({
+    history,
+    useHash: uiSettings!.get('state:storeInSessionStorage'),
+    ...withNotifyOnErrors(notifications!.toasts),
+  });
+
+  const indexPattern = useInitExploratoryView(kbnUrlStateStorage);
+
+  return (
+    <WithHeaderLayout
+      headerColor={theme.eui.euiColorEmptyShade}
+      bodyColor={theme.eui.euiPageBackgroundColor}
+    >
+      {indexPattern ? (
+        <IndexPatternContextProvider indexPattern={indexPattern!}>
+          <UrlStorageContextProvider storage={kbnUrlStateStorage}>
+            <ExploratoryView />
+          </UrlStorageContextProvider>
+        </IndexPatternContextProvider>
+      ) : null}
+    </WithHeaderLayout>
+  );
+}
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/rtl_helpers.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/rtl_helpers.tsx
new file mode 100644
index 0000000000000..112bfcc3ccb58
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/rtl_helpers.tsx
@@ -0,0 +1,318 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { of } from 'rxjs';
+import React, { ReactElement } from 'react';
+import { stringify } from 'query-string';
+// eslint-disable-next-line import/no-extraneous-dependencies
+import { render as reactTestLibRender, RenderOptions } from '@testing-library/react';
+import { Router } from 'react-router-dom';
+import { createMemoryHistory, History } from 'history';
+import { CoreStart } from 'kibana/public';
+import { I18nProvider } from '@kbn/i18n/react';
+import { coreMock } from 'src/core/public/mocks';
+import {
+  KibanaServices,
+  KibanaContextProvider,
+} from '../../../../../../../src/plugins/kibana_react/public';
+import { ObservabilityPublicPluginsStart } from '../../../plugin';
+import { EuiThemeProvider } from '../../../../../../../src/plugins/kibana_react/common';
+import { lensPluginMock } from '../../../../../lens/public/mocks';
+import { IndexPatternContextProvider } from './hooks/use_default_index_pattern';
+import { AllSeries, UrlStorageContextProvider } from './hooks/use_url_strorage';
+import {
+  withNotifyOnErrors,
+  createKbnUrlStateStorage,
+} from '../../../../../../../src/plugins/kibana_utils/public';
+import * as fetcherHook from '../../../hooks/use_fetcher';
+import * as useUrlHook from './hooks/use_url_strorage';
+import * as useSeriesFilterHook from './hooks/use_series_filters';
+import * as useHasDataHook from '../../../hooks/use_has_data';
+import * as useValuesListHook from '../../../hooks/use_values_list';
+
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { getStubIndexPattern } from '../../../../../../../src/plugins/data/public/index_patterns/index_pattern.stub';
+import indexPatternData from './configurations/data/test_index_pattern.json';
+
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { setIndexPatterns } from '../../../../../../../src/plugins/data/public/services';
+import { IndexPatternsContract } from '../../../../../../../src/plugins/data/common/index_patterns/index_patterns';
+import { UrlFilter } from './types';
+import { dataPluginMock } from '../../../../../../../src/plugins/data/public/mocks';
+
+interface KibanaProps {
+  services?: KibanaServices;
+}
+
+export interface KibanaProviderOptions<ExtraCore> {
+  core?: ExtraCore & Partial<CoreStart>;
+  kibanaProps?: KibanaProps;
+}
+
+interface MockKibanaProviderProps<ExtraCore extends Partial<CoreStart>>
+  extends KibanaProviderOptions<ExtraCore> {
+  children: ReactElement;
+  history: History;
+}
+
+type MockRouterProps<ExtraCore extends Partial<CoreStart>> = MockKibanaProviderProps<ExtraCore>;
+
+type Url =
+  | string
+  | {
+      path: string;
+      queryParams: Record<string, string | number>;
+    };
+
+interface RenderRouterOptions<ExtraCore> extends KibanaProviderOptions<ExtraCore> {
+  history?: History;
+  renderOptions?: Omit<RenderOptions, 'queries'>;
+  url?: Url;
+}
+
+function getSetting<T = any>(key: string): T {
+  if (key === 'timepicker:quickRanges') {
+    return ([
+      {
+        display: 'Today',
+        from: 'now/d',
+        to: 'now/d',
+      },
+    ] as unknown) as T;
+  }
+  return ('MMM D, YYYY @ HH:mm:ss.SSS' as unknown) as T;
+}
+
+function setSetting$<T = any>(key: string): T {
+  return (of('MMM D, YYYY @ HH:mm:ss.SSS') as unknown) as T;
+}
+
+/* default mock core */
+const defaultCore = coreMock.createStart();
+export const mockCore: () => Partial<CoreStart & ObservabilityPublicPluginsStart> = () => {
+  const core: Partial<CoreStart & ObservabilityPublicPluginsStart> = {
+    ...defaultCore,
+    application: {
+      ...defaultCore.application,
+      getUrlForApp: () => '/app/observability',
+      navigateToUrl: jest.fn(),
+      capabilities: {
+        ...defaultCore.application.capabilities,
+        observability: {
+          'alerting:save': true,
+          configureSettings: true,
+          save: true,
+          show: true,
+        },
+      },
+    },
+    uiSettings: {
+      ...defaultCore.uiSettings,
+      get: getSetting,
+      get$: setSetting$,
+    },
+    lens: lensPluginMock.createStartContract(),
+    data: dataPluginMock.createStartContract(),
+  };
+
+  return core;
+};
+
+/* Mock Provider Components */
+export function MockKibanaProvider<ExtraCore extends Partial<CoreStart>>({
+  children,
+  core,
+  history,
+  kibanaProps,
+}: MockKibanaProviderProps<ExtraCore>) {
+  const { notifications } = core!;
+
+  const kbnUrlStateStorage = createKbnUrlStateStorage({
+    history,
+    useHash: false,
+    ...withNotifyOnErrors(notifications!.toasts),
+  });
+
+  const indexPattern = mockIndexPattern;
+
+  setIndexPatterns(({
+    ...[indexPattern],
+    get: async () => indexPattern,
+  } as unknown) as IndexPatternsContract);
+
+  return (
+    <KibanaContextProvider services={{ ...core }} {...kibanaProps}>
+      <EuiThemeProvider darkMode={false}>
+        <I18nProvider>
+          <IndexPatternContextProvider indexPattern={indexPattern}>
+            <UrlStorageContextProvider storage={kbnUrlStateStorage}>
+              {children}
+            </UrlStorageContextProvider>
+          </IndexPatternContextProvider>
+        </I18nProvider>
+      </EuiThemeProvider>
+    </KibanaContextProvider>
+  );
+}
+
+export function MockRouter<ExtraCore>({
+  children,
+  core,
+  history = createMemoryHistory(),
+  kibanaProps,
+}: MockRouterProps<ExtraCore>) {
+  return (
+    <Router history={history}>
+      <MockKibanaProvider core={core} kibanaProps={kibanaProps} history={history}>
+        {children}
+      </MockKibanaProvider>
+    </Router>
+  );
+}
+
+/* Custom react testing library render */
+export function render<ExtraCore>(
+  ui: ReactElement,
+  {
+    history = createMemoryHistory(),
+    core: customCore,
+    kibanaProps,
+    renderOptions,
+    url,
+  }: RenderRouterOptions<ExtraCore> = {}
+) {
+  if (url) {
+    history = getHistoryFromUrl(url);
+  }
+
+  const core = {
+    ...mockCore(),
+    ...customCore,
+  };
+
+  return {
+    ...reactTestLibRender(
+      <MockRouter history={history} kibanaProps={kibanaProps} core={core}>
+        {ui}
+      </MockRouter>,
+      renderOptions
+    ),
+    history,
+    core,
+  };
+}
+
+const getHistoryFromUrl = (url: Url) => {
+  if (typeof url === 'string') {
+    return createMemoryHistory({
+      initialEntries: [url],
+    });
+  }
+
+  return createMemoryHistory({
+    initialEntries: [url.path + stringify(url.queryParams)],
+  });
+};
+
+export const mockFetcher = (data: any) => {
+  return jest.spyOn(fetcherHook, 'useFetcher').mockReturnValue({
+    data,
+    status: fetcherHook.FETCH_STATUS.SUCCESS,
+    refetch: jest.fn(),
+  });
+};
+
+export const mockUseHasData = () => {
+  const onRefreshTimeRange = jest.fn();
+  const spy = jest.spyOn(useHasDataHook, 'useHasData').mockReturnValue({
+    onRefreshTimeRange,
+  } as any);
+  return { spy, onRefreshTimeRange };
+};
+
+export const mockUseValuesList = (values?: string[]) => {
+  const onRefreshTimeRange = jest.fn();
+  const spy = jest.spyOn(useValuesListHook, 'useValuesList').mockReturnValue({
+    values: values ?? [],
+  } as any);
+  return { spy, onRefreshTimeRange };
+};
+
+export const mockUrlStorage = ({
+  data,
+  filters,
+  breakdown,
+}: {
+  data?: AllSeries;
+  filters?: UrlFilter[];
+  breakdown?: string;
+}) => {
+  const mockDataSeries = data || {
+    'performance-distribution': {
+      reportType: 'pld',
+      breakdown: breakdown || 'user_agent.name',
+      time: { from: 'now-15m', to: 'now' },
+      ...(filters ? { filters } : {}),
+    },
+  };
+  const allSeriesIds = Object.keys(mockDataSeries);
+  const firstSeriesId = allSeriesIds?.[0];
+
+  const series = mockDataSeries[firstSeriesId];
+
+  const removeSeries = jest.fn();
+  const setSeries = jest.fn();
+
+  const spy = jest.spyOn(useUrlHook, 'useUrlStorage').mockReturnValue({
+    firstSeriesId,
+    allSeriesIds,
+    removeSeries,
+    setSeries,
+    series,
+    firstSeries: mockDataSeries[firstSeriesId],
+    allSeries: mockDataSeries,
+  } as any);
+
+  return { spy, removeSeries, setSeries };
+};
+
+export function mockUseSeriesFilter() {
+  const removeFilter = jest.fn();
+  const invertFilter = jest.fn();
+  const setFilter = jest.fn();
+  const spy = jest.spyOn(useSeriesFilterHook, 'useSeriesFilters').mockReturnValue({
+    removeFilter,
+    invertFilter,
+    setFilter,
+  });
+
+  return {
+    spy,
+    removeFilter,
+    invertFilter,
+    setFilter,
+  };
+}
+
+const hist = createMemoryHistory();
+export const mockHistory = {
+  ...hist,
+  createHref: jest.fn(({ pathname }) => `/observability${pathname}`),
+  push: jest.fn(),
+  location: {
+    ...hist.location,
+    pathname: '/current-path',
+  },
+};
+
+export const mockIndexPattern = getStubIndexPattern(
+  'apm-*',
+  () => {},
+  '@timestamp',
+  JSON.parse(indexPatternData.attributes.fields),
+  mockCore() as any
+);
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/data_types_col.test.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/data_types_col.test.tsx
new file mode 100644
index 0000000000000..d33d8515d3bee
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/data_types_col.test.tsx
@@ -0,0 +1,59 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { fireEvent, screen } from '@testing-library/react';
+import { mockUrlStorage, render } from '../../rtl_helpers';
+import { dataTypes, DataTypesCol } from './data_types_col';
+import { NEW_SERIES_KEY } from '../../hooks/use_url_strorage';
+
+describe('DataTypesCol', function () {
+  it('should render properly', function () {
+    const { getByText } = render(<DataTypesCol />);
+
+    dataTypes.forEach(({ label }) => {
+      getByText(label);
+    });
+  });
+
+  it('should set series on change', function () {
+    const { setSeries } = mockUrlStorage({});
+
+    render(<DataTypesCol />);
+
+    fireEvent.click(screen.getByText(/user experience\(rum\)/i));
+
+    expect(setSeries).toHaveBeenCalledTimes(1);
+    expect(setSeries).toHaveBeenCalledWith('newSeriesKey', { dataType: 'rum' });
+  });
+
+  it('should set series on change on already selected', function () {
+    const { setSeries } = mockUrlStorage({
+      data: {
+        [NEW_SERIES_KEY]: {
+          dataType: 'synthetics',
+          reportType: 'upp',
+          breakdown: 'monitor.status',
+          time: { from: 'now-15m', to: 'now' },
+        },
+      },
+    });
+
+    render(<DataTypesCol />);
+
+    const button = screen.getByRole('button', {
+      name: /Synthetic Monitoring/i,
+    });
+
+    expect(button.classList).toContain('euiButton--fill');
+
+    fireEvent.click(button);
+
+    // undefined on click selected
+    expect(setSeries).toHaveBeenCalledWith('newSeriesKey', { dataType: undefined });
+  });
+});
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/data_types_col.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/data_types_col.tsx
new file mode 100644
index 0000000000000..7ea44e66a721a
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/data_types_col.tsx
@@ -0,0 +1,56 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { EuiButton, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import { AppDataType } from '../../types';
+import { useIndexPatternContext } from '../../hooks/use_default_index_pattern';
+import { NEW_SERIES_KEY, useUrlStorage } from '../../hooks/use_url_strorage';
+
+export const dataTypes: Array<{ id: AppDataType; label: string }> = [
+  { id: 'synthetics', label: 'Synthetic Monitoring' },
+  { id: 'rum', label: 'User Experience(RUM)' },
+  { id: 'logs', label: 'Logs' },
+  { id: 'metrics', label: 'Metrics' },
+  { id: 'apm', label: 'APM' },
+];
+
+export function DataTypesCol() {
+  const { series, setSeries } = useUrlStorage(NEW_SERIES_KEY);
+
+  const { loadIndexPattern } = useIndexPatternContext();
+
+  const onDataTypeChange = (dataType?: AppDataType) => {
+    if (dataType) {
+      loadIndexPattern(dataType);
+    }
+    setSeries(NEW_SERIES_KEY, { dataType } as any);
+  };
+
+  const selectedDataType = series.dataType;
+
+  return (
+    <EuiFlexGroup direction="column" gutterSize="xs">
+      {dataTypes.map(({ id: dataTypeId, label }) => (
+        <EuiFlexItem key={dataTypeId}>
+          <EuiButton
+            size="s"
+            iconSide="right"
+            iconType="arrowRight"
+            color={selectedDataType === dataTypeId ? 'primary' : 'text'}
+            fill={selectedDataType === dataTypeId}
+            onClick={() => {
+              onDataTypeChange(dataTypeId === selectedDataType ? undefined : dataTypeId);
+            }}
+          >
+            {label}
+          </EuiButton>
+        </EuiFlexItem>
+      ))}
+    </EuiFlexGroup>
+  );
+}
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/report_breakdowns.test.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/report_breakdowns.test.tsx
new file mode 100644
index 0000000000000..dba660fff9c36
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/report_breakdowns.test.tsx
@@ -0,0 +1,75 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { fireEvent, screen } from '@testing-library/react';
+import { render } from '../../../../../utils/test_helper';
+import { getDefaultConfigs } from '../../configurations/default_configs';
+import { mockIndexPattern, mockUrlStorage } from '../../rtl_helpers';
+import { NEW_SERIES_KEY } from '../../hooks/use_url_strorage';
+import { ReportBreakdowns } from './report_breakdowns';
+import { USER_AGENT_OS } from '../../configurations/data/elasticsearch_fieldnames';
+
+describe('Series Builder ReportBreakdowns', function () {
+  const dataViewSeries = getDefaultConfigs({
+    reportType: 'pld',
+    indexPattern: mockIndexPattern,
+    seriesId: NEW_SERIES_KEY,
+  });
+
+  it('should render properly', function () {
+    mockUrlStorage({});
+
+    render(<ReportBreakdowns dataViewSeries={dataViewSeries} />);
+
+    screen.getByText('Select an option: , is selected');
+    screen.getAllByText('Browser family');
+  });
+
+  it('should set new series breakdown on change', function () {
+    const { setSeries } = mockUrlStorage({});
+
+    render(<ReportBreakdowns dataViewSeries={dataViewSeries} />);
+
+    const btn = screen.getByRole('button', {
+      name: /select an option: Browser family , is selected/i,
+      hidden: true,
+    });
+
+    fireEvent.click(btn);
+
+    fireEvent.click(screen.getByText(/operating system/i));
+
+    expect(setSeries).toHaveBeenCalledTimes(1);
+    expect(setSeries).toHaveBeenCalledWith('newSeriesKey', {
+      breakdown: USER_AGENT_OS,
+      reportType: 'pld',
+      time: { from: 'now-15m', to: 'now' },
+    });
+  });
+  it('should set undefined on new series on no select breakdown', function () {
+    const { setSeries } = mockUrlStorage({});
+
+    render(<ReportBreakdowns dataViewSeries={dataViewSeries} />);
+
+    const btn = screen.getByRole('button', {
+      name: /select an option: Browser family , is selected/i,
+      hidden: true,
+    });
+
+    fireEvent.click(btn);
+
+    fireEvent.click(screen.getByText(/no breakdown/i));
+
+    expect(setSeries).toHaveBeenCalledTimes(1);
+    expect(setSeries).toHaveBeenCalledWith('newSeriesKey', {
+      breakdown: undefined,
+      reportType: 'pld',
+      time: { from: 'now-15m', to: 'now' },
+    });
+  });
+});
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/report_breakdowns.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/report_breakdowns.tsx
new file mode 100644
index 0000000000000..7667cea417a52
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/report_breakdowns.tsx
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { Breakdowns } from '../../series_editor/columns/breakdowns';
+import { NEW_SERIES_KEY } from '../../hooks/use_url_strorage';
+import { DataSeries } from '../../types';
+
+export function ReportBreakdowns({ dataViewSeries }: { dataViewSeries: DataSeries }) {
+  return <Breakdowns breakdowns={dataViewSeries.breakdowns ?? []} seriesId={NEW_SERIES_KEY} />;
+}
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/report_definition_col.test.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/report_definition_col.test.tsx
new file mode 100644
index 0000000000000..2fda581154166
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/report_definition_col.test.tsx
@@ -0,0 +1,75 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { fireEvent, screen } from '@testing-library/react';
+import { getDefaultConfigs } from '../../configurations/default_configs';
+import { mockIndexPattern, mockUrlStorage, mockUseValuesList, render } from '../../rtl_helpers';
+import { NEW_SERIES_KEY } from '../../hooks/use_url_strorage';
+import { ReportDefinitionCol } from './report_definition_col';
+import { SERVICE_NAME } from '../../configurations/data/elasticsearch_fieldnames';
+
+describe('Series Builder ReportDefinitionCol', function () {
+  const dataViewSeries = getDefaultConfigs({
+    reportType: 'pld',
+    indexPattern: mockIndexPattern,
+    seriesId: NEW_SERIES_KEY,
+  });
+
+  const { setSeries } = mockUrlStorage({
+    data: {
+      'performance-dist': {
+        dataType: 'rum',
+        reportType: 'pld',
+        time: { from: 'now-30d', to: 'now' },
+        reportDefinitions: { [SERVICE_NAME]: 'elastic-co' },
+      },
+    },
+  });
+
+  it('should render properly', async function () {
+    render(<ReportDefinitionCol dataViewSeries={dataViewSeries} />);
+
+    screen.getByText('Web Application');
+    screen.getByText('Environment');
+    screen.getByText('Select an option: Page load time, is selected');
+    screen.getByText('Page load time');
+  });
+
+  it('should render selected report definitions', function () {
+    render(<ReportDefinitionCol dataViewSeries={dataViewSeries} />);
+
+    screen.getByText('elastic-co');
+  });
+
+  it('should be able to remove selected definition', function () {
+    render(<ReportDefinitionCol dataViewSeries={dataViewSeries} />);
+
+    const removeBtn = screen.getByText(/elastic-co/i);
+
+    fireEvent.click(removeBtn);
+
+    expect(setSeries).toHaveBeenCalledTimes(1);
+    expect(setSeries).toHaveBeenCalledWith('newSeriesKey', {
+      dataType: 'rum',
+      reportDefinitions: {},
+      reportType: 'pld',
+      time: { from: 'now-30d', to: 'now' },
+    });
+  });
+
+  it('should be able to unselected selected definition', async function () {
+    mockUseValuesList(['elastic-co']);
+    render(<ReportDefinitionCol dataViewSeries={dataViewSeries} />);
+
+    const definitionBtn = screen.getByText(/web application/i);
+
+    fireEvent.click(definitionBtn);
+
+    screen.getByText('Apply');
+  });
+});
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/report_definition_col.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/report_definition_col.tsx
new file mode 100644
index 0000000000000..ce11c869de0ab
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/report_definition_col.tsx
@@ -0,0 +1,95 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { EuiBadge, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import { useIndexPatternContext } from '../../hooks/use_default_index_pattern';
+import { NEW_SERIES_KEY, useUrlStorage } from '../../hooks/use_url_strorage';
+import { CustomReportField } from '../custom_report_field';
+import FieldValueSuggestions from '../../../field_value_suggestions';
+import { DataSeries } from '../../types';
+
+export function ReportDefinitionCol({ dataViewSeries }: { dataViewSeries: DataSeries }) {
+  const { indexPattern } = useIndexPatternContext();
+
+  const { series, setSeries } = useUrlStorage(NEW_SERIES_KEY);
+
+  const { reportDefinitions: rtd = {} } = series;
+
+  const { reportDefinitions, labels, filters } = dataViewSeries;
+
+  const onChange = (field: string, value?: string) => {
+    if (!value) {
+      delete rtd[field];
+      setSeries(NEW_SERIES_KEY, {
+        ...series,
+        reportDefinitions: { ...rtd },
+      });
+    } else {
+      setSeries(NEW_SERIES_KEY, {
+        ...series,
+        reportDefinitions: { ...rtd, [field]: value },
+      });
+    }
+  };
+
+  const onRemove = (field: string) => {
+    delete rtd[field];
+    setSeries(NEW_SERIES_KEY, {
+      ...series,
+      reportDefinitions: rtd,
+    });
+  };
+
+  return (
+    <EuiFlexGroup direction="column" gutterSize="s">
+      {indexPattern &&
+        reportDefinitions.map(({ field, custom, options, defaultValue }) => (
+          <EuiFlexItem key={field}>
+            {!custom ? (
+              <EuiFlexGroup justifyContent="flexStart" gutterSize="s" alignItems="center">
+                <EuiFlexItem grow={false}>
+                  <FieldValueSuggestions
+                    label={labels[field]}
+                    sourceField={field}
+                    indexPattern={indexPattern}
+                    value={rtd?.[field]}
+                    onChange={(val?: string) => onChange(field, val)}
+                    filters={(filters ?? []).map(({ query }) => query)}
+                    time={series.time}
+                    width={200}
+                  />
+                </EuiFlexItem>
+                {rtd?.[field] && (
+                  <EuiFlexItem grow={false}>
+                    <EuiBadge
+                      iconSide="right"
+                      iconType="cross"
+                      color="hollow"
+                      onClick={() => onRemove(field)}
+                      iconOnClick={() => onRemove(field)}
+                      iconOnClickAriaLabel={'Click to remove'}
+                      onClickAriaLabel={'Click to remove'}
+                    >
+                      {rtd?.[field]}
+                    </EuiBadge>
+                  </EuiFlexItem>
+                )}
+              </EuiFlexGroup>
+            ) : (
+              <CustomReportField
+                field={field}
+                options={options}
+                defaultValue={defaultValue}
+                seriesId={NEW_SERIES_KEY}
+              />
+            )}
+          </EuiFlexItem>
+        ))}
+    </EuiFlexGroup>
+  );
+}
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/report_filters.test.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/report_filters.test.tsx
new file mode 100644
index 0000000000000..674f5e6f49bde
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/report_filters.test.tsx
@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { screen } from '@testing-library/react';
+import { render } from '../../../../../utils/test_helper';
+import { ReportFilters } from './report_filters';
+import { getDefaultConfigs } from '../../configurations/default_configs';
+import { mockIndexPattern, mockUrlStorage } from '../../rtl_helpers';
+import { NEW_SERIES_KEY } from '../../hooks/use_url_strorage';
+
+describe('Series Builder ReportFilters', function () {
+  const dataViewSeries = getDefaultConfigs({
+    reportType: 'pld',
+    indexPattern: mockIndexPattern,
+    seriesId: NEW_SERIES_KEY,
+  });
+  mockUrlStorage({});
+  it('should render properly', function () {
+    render(<ReportFilters dataViewSeries={dataViewSeries} />);
+
+    screen.getByText('Add filter');
+  });
+});
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/report_filters.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/report_filters.tsx
new file mode 100644
index 0000000000000..903dda549aeee
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/report_filters.tsx
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { SeriesFilter } from '../../series_editor/columns/series_filter';
+import { NEW_SERIES_KEY } from '../../hooks/use_url_strorage';
+import { DataSeries } from '../../types';
+
+export function ReportFilters({ dataViewSeries }: { dataViewSeries: DataSeries }) {
+  return (
+    <SeriesFilter
+      series={dataViewSeries}
+      defaultFilters={dataViewSeries.defaultFilters}
+      seriesId={NEW_SERIES_KEY}
+      isNew={true}
+    />
+  );
+}
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/report_types_col.test.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/report_types_col.test.tsx
new file mode 100644
index 0000000000000..567e2654130e8
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/report_types_col.test.tsx
@@ -0,0 +1,65 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { fireEvent, screen } from '@testing-library/react';
+import { mockUrlStorage, render } from '../../rtl_helpers';
+import { ReportTypesCol, SELECTED_DATA_TYPE_FOR_REPORT } from './report_types_col';
+import { ReportTypes } from '../series_builder';
+
+describe('ReportTypesCol', function () {
+  it('should render properly', function () {
+    render(<ReportTypesCol reportTypes={ReportTypes.rum} />);
+    screen.getByText('Performance distribution');
+    screen.getByText('KPI over time');
+  });
+
+  it('should display empty message', function () {
+    render(<ReportTypesCol reportTypes={[]} />);
+    screen.getByText(SELECTED_DATA_TYPE_FOR_REPORT);
+  });
+
+  it('should set series on change', function () {
+    const { setSeries } = mockUrlStorage({});
+    render(<ReportTypesCol reportTypes={ReportTypes.synthetics} />);
+
+    fireEvent.click(screen.getByText(/monitor duration/i));
+
+    expect(setSeries).toHaveBeenCalledWith('newSeriesKey', {
+      breakdown: 'user_agent.name',
+      reportDefinitions: {},
+      reportType: 'upd',
+      time: { from: 'now-15m', to: 'now' },
+    });
+    expect(setSeries).toHaveBeenCalledTimes(1);
+  });
+
+  it('should set selected as filled', function () {
+    const { setSeries } = mockUrlStorage({
+      data: {
+        newSeriesKey: {
+          dataType: 'synthetics',
+          reportType: 'upp',
+          breakdown: 'monitor.status',
+          time: { from: 'now-15m', to: 'now' },
+        },
+      },
+    });
+
+    render(<ReportTypesCol reportTypes={ReportTypes.synthetics} />);
+
+    const button = screen.getByRole('button', {
+      name: /pings histogram/i,
+    });
+
+    expect(button.classList).toContain('euiButton--fill');
+    fireEvent.click(button);
+
+    // undefined on click selected
+    expect(setSeries).toHaveBeenCalledWith('newSeriesKey', { dataType: 'synthetics' });
+  });
+});
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/report_types_col.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/report_types_col.tsx
new file mode 100644
index 0000000000000..5c94a5bca60f8
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/columns/report_types_col.tsx
@@ -0,0 +1,61 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { i18n } from '@kbn/i18n';
+import { EuiButton, EuiFlexGroup, EuiFlexItem, EuiText } from '@elastic/eui';
+import { ReportViewTypeId, SeriesUrl } from '../../types';
+import { NEW_SERIES_KEY, useUrlStorage } from '../../hooks/use_url_strorage';
+
+interface Props {
+  reportTypes: Array<{ id: ReportViewTypeId; label: string }>;
+}
+
+export function ReportTypesCol({ reportTypes }: Props) {
+  const {
+    series: { reportType: selectedReportType, ...restSeries },
+    setSeries,
+  } = useUrlStorage(NEW_SERIES_KEY);
+
+  return reportTypes?.length > 0 ? (
+    <EuiFlexGroup direction="column" gutterSize="xs">
+      {reportTypes.map(({ id: reportType, label }) => (
+        <EuiFlexItem key={reportType}>
+          <EuiButton
+            size="s"
+            iconSide="right"
+            iconType="arrowRight"
+            color={selectedReportType === reportType ? 'primary' : 'text'}
+            fill={selectedReportType === reportType}
+            onClick={() => {
+              if (reportType === selectedReportType) {
+                setSeries(NEW_SERIES_KEY, {
+                  dataType: restSeries.dataType,
+                } as SeriesUrl);
+              } else {
+                setSeries(NEW_SERIES_KEY, {
+                  ...restSeries,
+                  reportType,
+                  reportDefinitions: {},
+                });
+              }
+            }}
+          >
+            {label}
+          </EuiButton>
+        </EuiFlexItem>
+      ))}
+    </EuiFlexGroup>
+  ) : (
+    <EuiText color="subdued">{SELECTED_DATA_TYPE_FOR_REPORT}</EuiText>
+  );
+}
+
+export const SELECTED_DATA_TYPE_FOR_REPORT = i18n.translate(
+  'xpack.observability.expView.reportType.noDataType',
+  { defaultMessage: 'Select a data type to start building a series.' }
+);
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/custom_report_field.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/custom_report_field.tsx
new file mode 100644
index 0000000000000..6039fd4cba280
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/custom_report_field.tsx
@@ -0,0 +1,47 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { EuiSuperSelect } from '@elastic/eui';
+import { useUrlStorage } from '../hooks/use_url_strorage';
+import { ReportDefinition } from '../types';
+
+interface Props {
+  field: string;
+  seriesId: string;
+  defaultValue?: string;
+  options: ReportDefinition['options'];
+}
+
+export function CustomReportField({ field, seriesId, options: opts, defaultValue }: Props) {
+  const { series, setSeries } = useUrlStorage(seriesId);
+
+  const { reportDefinitions: rtd = {} } = series;
+
+  const onChange = (value: string) => {
+    setSeries(seriesId, { ...series, reportDefinitions: { ...rtd, [field]: value } });
+  };
+
+  const { reportDefinitions } = series;
+
+  const NO_SELECT = 'no_select';
+
+  const options = [{ label: 'Select metric', field: NO_SELECT }, ...(opts ?? [])];
+
+  return (
+    <div style={{ maxWidth: 200 }}>
+      <EuiSuperSelect
+        options={options.map(({ label, field: fd, description }) => ({
+          value: fd,
+          inputDisplay: label,
+        }))}
+        valueOfSelected={reportDefinitions?.[field] || defaultValue || NO_SELECT}
+        onChange={(value) => onChange(value)}
+      />
+    </div>
+  );
+}
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/series_builder.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/series_builder.tsx
new file mode 100644
index 0000000000000..983c18af031d0
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_builder/series_builder.tsx
@@ -0,0 +1,201 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useState } from 'react';
+
+import { i18n } from '@kbn/i18n';
+import { EuiButton, EuiBasicTable, EuiSpacer, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import styled from 'styled-components';
+import { AppDataType, ReportViewTypeId, ReportViewTypes, SeriesUrl } from '../types';
+import { DataTypesCol } from './columns/data_types_col';
+import { ReportTypesCol } from './columns/report_types_col';
+import { ReportDefinitionCol } from './columns/report_definition_col';
+import { ReportFilters } from './columns/report_filters';
+import { ReportBreakdowns } from './columns/report_breakdowns';
+import { NEW_SERIES_KEY, useUrlStorage } from '../hooks/use_url_strorage';
+import { useIndexPatternContext } from '../hooks/use_default_index_pattern';
+import { getDefaultConfigs } from '../configurations/default_configs';
+
+export const ReportTypes: Record<AppDataType, Array<{ id: ReportViewTypeId; label: string }>> = {
+  synthetics: [
+    { id: 'upd', label: 'Monitor duration' },
+    { id: 'upp', label: 'Pings histogram' },
+  ],
+  rum: [
+    { id: 'pld', label: 'Performance distribution' },
+    { id: 'kpi', label: 'KPI over time' },
+  ],
+  apm: [
+    { id: 'svl', label: 'Latency' },
+    { id: 'tpt', label: 'Throughput' },
+  ],
+  logs: [
+    {
+      id: 'logs',
+      label: 'Logs Frequency',
+    },
+  ],
+  metrics: [
+    { id: 'cpu', label: 'CPU usage' },
+    { id: 'mem', label: 'Memory usage' },
+    { id: 'nwk', label: 'Network activity' },
+  ],
+};
+
+export function SeriesBuilder() {
+  const { series, setSeries, allSeriesIds, removeSeries } = useUrlStorage(NEW_SERIES_KEY);
+
+  const { dataType, reportType, reportDefinitions = {}, filters = [] } = series;
+
+  const [isFlyoutVisible, setIsFlyoutVisible] = useState(!!series.dataType);
+
+  const { indexPattern } = useIndexPatternContext();
+
+  const getDataViewSeries = () => {
+    return getDefaultConfigs({
+      indexPattern,
+      reportType: reportType!,
+      seriesId: NEW_SERIES_KEY,
+    });
+  };
+
+  const columns = [
+    {
+      name: i18n.translate('xpack.observability.expView.seriesBuilder.dataType', {
+        defaultMessage: 'Data Type',
+      }),
+      width: '20%',
+      render: (val: string) => <DataTypesCol />,
+    },
+    {
+      name: i18n.translate('xpack.observability.expView.seriesBuilder.report', {
+        defaultMessage: 'Report',
+      }),
+      width: '20%',
+      render: (val: string) => (
+        <ReportTypesCol reportTypes={dataType ? ReportTypes[dataType] : []} />
+      ),
+    },
+    {
+      name: i18n.translate('xpack.observability.expView.seriesBuilder.definition', {
+        defaultMessage: 'Definition',
+      }),
+      width: '30%',
+      render: (val: string) =>
+        reportType && indexPattern ? (
+          <ReportDefinitionCol dataViewSeries={getDataViewSeries()} />
+        ) : null,
+    },
+    {
+      name: i18n.translate('xpack.observability.expView.seriesBuilder.filters', {
+        defaultMessage: 'Filters',
+      }),
+      width: '25%',
+      render: (val: string) =>
+        reportType && indexPattern ? <ReportFilters dataViewSeries={getDataViewSeries()} /> : null,
+    },
+    {
+      name: i18n.translate('xpack.observability.expView.seriesBuilder.breakdown', {
+        defaultMessage: 'Breakdowns',
+      }),
+      width: '25%',
+      field: 'id',
+      render: (val: string) =>
+        reportType && indexPattern ? (
+          <ReportBreakdowns dataViewSeries={getDataViewSeries()} />
+        ) : null,
+    },
+  ];
+
+  const addSeries = () => {
+    if (reportType) {
+      const newSeriesId = `${
+        reportDefinitions?.['service.name'] ||
+        reportDefinitions?.['monitor.id'] ||
+        ReportViewTypes[reportType]
+      }`;
+
+      const newSeriesN = {
+        reportType,
+        time: { from: 'now-30m', to: 'now' },
+        filters,
+        reportDefinitions,
+      } as SeriesUrl;
+
+      setSeries(newSeriesId, newSeriesN).then(() => {
+        removeSeries(NEW_SERIES_KEY);
+        setIsFlyoutVisible(false);
+      });
+    }
+  };
+
+  const items = [{ id: NEW_SERIES_KEY }];
+
+  let flyout;
+
+  if (isFlyoutVisible) {
+    flyout = (
+      <BottomFlyout aria-labelledby="flyoutTitle">
+        <EuiBasicTable
+          items={items as any}
+          columns={columns}
+          cellProps={{ style: { borderRight: '1px solid #d3dae6' } }}
+        />
+        <EuiSpacer />
+        <EuiFlexGroup justifyContent="flexEnd">
+          <EuiFlexItem grow={false}>
+            <EuiButton fill iconType="plus" color="primary" onClick={addSeries}>
+              {i18n.translate('xpack.observability.expView.seriesBuilder.add', {
+                defaultMessage: 'Add',
+              })}
+            </EuiButton>
+          </EuiFlexItem>
+          <EuiFlexItem grow={false}>
+            <EuiButton
+              iconType="cross"
+              color="text"
+              onClick={() => {
+                removeSeries(NEW_SERIES_KEY);
+                setIsFlyoutVisible(false);
+              }}
+            >
+              {i18n.translate('xpack.observability.expView.seriesBuilder.cancel', {
+                defaultMessage: 'Cancel',
+              })}
+            </EuiButton>
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </BottomFlyout>
+    );
+  }
+
+  return (
+    <div>
+      {!isFlyoutVisible && (
+        <>
+          <EuiButton
+            iconType={isFlyoutVisible ? 'arrowDown' : 'arrowRight'}
+            color="primary"
+            iconSide="right"
+            onClick={() => setIsFlyoutVisible((prevState) => !prevState)}
+            disabled={allSeriesIds.length > 0}
+          >
+            {i18n.translate('xpack.observability.expView.seriesBuilder.addSeries', {
+              defaultMessage: 'Add series',
+            })}
+          </EuiButton>
+          <EuiSpacer />
+        </>
+      )}
+      {flyout}
+    </div>
+  );
+}
+
+const BottomFlyout = styled.div`
+  height: 300px;
+`;
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/series_date_picker/index.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_date_picker/index.tsx
new file mode 100644
index 0000000000000..71e3317ad6db8
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_date_picker/index.tsx
@@ -0,0 +1,55 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiSuperDatePicker } from '@elastic/eui';
+import React, { useEffect } from 'react';
+import { useHasData } from '../../../../hooks/use_has_data';
+import { useUrlStorage } from '../hooks/use_url_strorage';
+import { useQuickTimeRanges } from '../../../../hooks/use_quick_time_ranges';
+
+export interface TimePickerTime {
+  from: string;
+  to: string;
+}
+
+export interface TimePickerQuickRange extends TimePickerTime {
+  display: string;
+}
+
+interface Props {
+  seriesId: string;
+}
+
+export function SeriesDatePicker({ seriesId }: Props) {
+  const { onRefreshTimeRange } = useHasData();
+
+  const commonlyUsedRanges = useQuickTimeRanges();
+
+  const { series, setSeries } = useUrlStorage(seriesId);
+
+  function onTimeChange({ start, end }: { start: string; end: string }) {
+    onRefreshTimeRange();
+    setSeries(seriesId, { ...series, time: { from: start, to: end } });
+  }
+
+  useEffect(() => {
+    if (!series || !series.time) {
+      setSeries(seriesId, { ...series, time: { from: 'now-5h', to: 'now' } });
+    }
+  }, [seriesId, series, setSeries]);
+
+  return (
+    <EuiSuperDatePicker
+      start={series?.time?.from}
+      end={series?.time?.to}
+      onTimeChange={onTimeChange}
+      commonlyUsedRanges={commonlyUsedRanges}
+      onRefresh={onTimeChange}
+      showUpdateButton={false}
+    />
+  );
+}
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/series_date_picker/series_date_picker.test.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_date_picker/series_date_picker.test.tsx
new file mode 100644
index 0000000000000..acc9ba9658a08
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_date_picker/series_date_picker.test.tsx
@@ -0,0 +1,76 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { mockUrlStorage, mockUseHasData, render } from '../rtl_helpers';
+import { fireEvent, waitFor } from '@testing-library/react';
+import { SeriesDatePicker } from './index';
+
+describe('SeriesDatePicker', function () {
+  it('should render properly', function () {
+    mockUrlStorage({
+      data: {
+        'uptime-pings-histogram': {
+          reportType: 'upp',
+          breakdown: 'monitor.status',
+          time: { from: 'now-30m', to: 'now' },
+        },
+      },
+    });
+    const { getByText } = render(<SeriesDatePicker seriesId={'series-id'} />);
+
+    getByText('Last 30 minutes');
+  });
+
+  it('should set defaults', async function () {
+    const { setSeries: setSeries1 } = mockUrlStorage({
+      data: {
+        'uptime-pings-histogram': {
+          reportType: 'upp',
+          breakdown: 'monitor.status',
+        },
+      },
+    } as any);
+    render(<SeriesDatePicker seriesId={'uptime-pings-histogram'} />);
+    expect(setSeries1).toHaveBeenCalledTimes(1);
+    expect(setSeries1).toHaveBeenCalledWith('uptime-pings-histogram', {
+      breakdown: 'monitor.status',
+      reportType: 'upp',
+      time: { from: 'now-5h', to: 'now' },
+    });
+  });
+
+  it('should set series data', async function () {
+    const { setSeries } = mockUrlStorage({
+      data: {
+        'uptime-pings-histogram': {
+          reportType: 'upp',
+          breakdown: 'monitor.status',
+          time: { from: 'now-30m', to: 'now' },
+        },
+      },
+    });
+
+    const { onRefreshTimeRange } = mockUseHasData();
+    const { getByTestId } = render(<SeriesDatePicker seriesId={'series-id'} />);
+
+    await waitFor(function () {
+      fireEvent.click(getByTestId('superDatePickerToggleQuickMenuButton'));
+    });
+
+    fireEvent.click(getByTestId('superDatePickerCommonlyUsed_Today'));
+
+    expect(onRefreshTimeRange).toHaveBeenCalledTimes(1);
+
+    expect(setSeries).toHaveBeenCalledWith('series-id', {
+      breakdown: 'monitor.status',
+      reportType: 'upp',
+      time: { from: 'now/d', to: 'now/d' },
+    });
+    expect(setSeries).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/actions_col.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/actions_col.tsx
new file mode 100644
index 0000000000000..c6209381a4da1
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/actions_col.tsx
@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import { DataSeries } from '../../types';
+import { SeriesChartTypes } from './chart_types';
+import { MetricSelection } from './metric_selection';
+
+interface Props {
+  series: DataSeries;
+}
+
+export function ActionsCol({ series }: Props) {
+  return (
+    <EuiFlexGroup direction="row" gutterSize="s" justifyContent="center">
+      <EuiFlexItem grow={false}>
+        <SeriesChartTypes seriesId={series.id} defaultChartType={series.seriesTypes[0]} />
+      </EuiFlexItem>
+      {series.hasMetricType && (
+        <EuiFlexItem grow={false}>
+          <MetricSelection seriesId={series.id} isDisabled={!series.hasMetricType} />
+        </EuiFlexItem>
+      )}
+    </EuiFlexGroup>
+  );
+}
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/breakdowns.test.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/breakdowns.test.tsx
new file mode 100644
index 0000000000000..654a93a08a7c8
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/breakdowns.test.tsx
@@ -0,0 +1,49 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { fireEvent, screen } from '@testing-library/react';
+import { Breakdowns } from './breakdowns';
+import { mockIndexPattern, mockUrlStorage, render } from '../../rtl_helpers';
+import { NEW_SERIES_KEY } from '../../hooks/use_url_strorage';
+import { getDefaultConfigs } from '../../configurations/default_configs';
+import { USER_AGENT_OS } from '../../configurations/data/elasticsearch_fieldnames';
+
+describe('Breakdowns', function () {
+  const dataViewSeries = getDefaultConfigs({
+    reportType: 'pld',
+    indexPattern: mockIndexPattern,
+    seriesId: NEW_SERIES_KEY,
+  });
+
+  it('should render properly', async function () {
+    mockUrlStorage({});
+
+    render(<Breakdowns seriesId={'series-id'} breakdowns={dataViewSeries.breakdowns} />);
+
+    screen.getAllByText('Browser family');
+  });
+
+  it('should call set series on change', function () {
+    const { setSeries } = mockUrlStorage({ breakdown: USER_AGENT_OS });
+
+    render(<Breakdowns seriesId={'series-id'} breakdowns={dataViewSeries.breakdowns} />);
+
+    screen.getAllByText('Operating system');
+
+    fireEvent.click(screen.getByTestId('seriesBreakdown'));
+
+    fireEvent.click(screen.getByText('Browser family'));
+
+    expect(setSeries).toHaveBeenCalledWith('series-id', {
+      breakdown: 'user_agent.name',
+      reportType: 'pld',
+      time: { from: 'now-15m', to: 'now' },
+    });
+    expect(setSeries).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/breakdowns.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/breakdowns.tsx
new file mode 100644
index 0000000000000..0d34d7245725a
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/breakdowns.tsx
@@ -0,0 +1,65 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { EuiSuperSelect } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { FieldLabels } from '../../configurations/constants';
+import { useUrlStorage } from '../../hooks/use_url_strorage';
+
+interface Props {
+  seriesId: string;
+  breakdowns: string[];
+}
+
+export function Breakdowns({ seriesId, breakdowns = [] }: Props) {
+  const { setSeries, series } = useUrlStorage(seriesId);
+
+  const selectedBreakdown = series.breakdown;
+  const NO_BREAKDOWN = 'no_breakdown';
+
+  const onOptionChange = (optionId: string) => {
+    if (optionId === NO_BREAKDOWN) {
+      setSeries(seriesId, {
+        ...series,
+        breakdown: undefined,
+      });
+    } else {
+      setSeries(seriesId, {
+        ...series,
+        breakdown: selectedBreakdown === optionId ? undefined : optionId,
+      });
+    }
+  };
+
+  const items = breakdowns.map((breakdown) => ({ id: breakdown, label: FieldLabels[breakdown] }));
+  items.push({
+    id: NO_BREAKDOWN,
+    label: i18n.translate('xpack.observability.exp.breakDownFilter.noBreakdown', {
+      defaultMessage: 'No breakdown',
+    }),
+  });
+
+  const options = items.map(({ id, label }) => ({
+    inputDisplay: id === NO_BREAKDOWN ? label : <strong>{label}</strong>,
+    value: id,
+    dropdownDisplay: label,
+  }));
+
+  return (
+    <div style={{ width: 200 }}>
+      <EuiSuperSelect
+        fullWidth
+        compressed
+        options={options}
+        valueOfSelected={selectedBreakdown ?? NO_BREAKDOWN}
+        onChange={(value) => onOptionChange(value)}
+        data-test-subj={'seriesBreakdown'}
+      />
+    </div>
+  );
+}
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/chart_types.test.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/chart_types.test.tsx
new file mode 100644
index 0000000000000..f291d0de4dac0
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/chart_types.test.tsx
@@ -0,0 +1,56 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { fireEvent, screen, waitFor } from '@testing-library/react';
+import { SeriesChartTypes, XYChartTypes } from './chart_types';
+import { mockUrlStorage, render } from '../../rtl_helpers';
+
+describe.skip('SeriesChartTypes', function () {
+  it('should render properly', async function () {
+    mockUrlStorage({});
+
+    render(<SeriesChartTypes seriesId={'series-id'} defaultChartType={'line'} />);
+
+    await waitFor(() => {
+      screen.getByText(/chart type/i);
+    });
+  });
+
+  it('should call set series on change', async function () {
+    const { setSeries } = mockUrlStorage({});
+
+    render(<SeriesChartTypes seriesId={'series-id'} defaultChartType={'line'} />);
+
+    await waitFor(() => {
+      screen.getByText(/chart type/i);
+    });
+
+    fireEvent.click(screen.getByText(/chart type/i));
+    fireEvent.click(screen.getByTestId('lnsXY_seriesType-bar_stacked'));
+
+    expect(setSeries).toHaveBeenNthCalledWith(1, 'performance-distribution', {
+      breakdown: 'user_agent.name',
+      reportType: 'pld',
+      seriesType: 'bar_stacked',
+      time: { from: 'now-15m', to: 'now' },
+    });
+    expect(setSeries).toHaveBeenCalledTimes(3);
+  });
+
+  describe('XYChartTypes', function () {
+    it('should render properly', async function () {
+      mockUrlStorage({});
+
+      render(<XYChartTypes value={'line'} onChange={jest.fn()} label={'Chart type'} />);
+
+      await waitFor(() => {
+        screen.getByText(/chart type/i);
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/chart_types.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/chart_types.tsx
new file mode 100644
index 0000000000000..017655053eef2
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/chart_types.tsx
@@ -0,0 +1,149 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useState } from 'react';
+
+import {
+  EuiButton,
+  EuiButtonGroup,
+  EuiButtonIcon,
+  EuiLoadingSpinner,
+  EuiPopover,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import styled from 'styled-components';
+import { useKibana } from '../../../../../../../../../src/plugins/kibana_react/public';
+import { ObservabilityPublicPluginsStart } from '../../../../../plugin';
+import { useFetcher } from '../../../../..';
+import { useUrlStorage } from '../../hooks/use_url_strorage';
+import { SeriesType } from '../../../../../../../lens/public';
+
+export function SeriesChartTypes({
+  seriesId,
+  defaultChartType,
+}: {
+  seriesId: string;
+  defaultChartType: SeriesType;
+}) {
+  const { series, setSeries, allSeries } = useUrlStorage(seriesId);
+
+  const seriesType = series?.seriesType ?? defaultChartType;
+
+  const onChange = (value: SeriesType) => {
+    Object.keys(allSeries).forEach((seriesKey) => {
+      const seriesN = allSeries[seriesKey];
+
+      setSeries(seriesKey, { ...seriesN, seriesType: value });
+    });
+  };
+
+  return (
+    <XYChartTypes
+      onChange={onChange}
+      value={seriesType}
+      excludeChartTypes={['bar_percentage_stacked']}
+      label={i18n.translate('xpack.observability.expView.chartTypes.label', {
+        defaultMessage: 'Chart type',
+      })}
+    />
+  );
+}
+
+export interface XYChartTypesProps {
+  onChange: (value: SeriesType) => void;
+  value: SeriesType;
+  label?: string;
+  includeChartTypes?: string[];
+  excludeChartTypes?: string[];
+}
+
+export function XYChartTypes({
+  onChange,
+  value,
+  label,
+  includeChartTypes,
+  excludeChartTypes,
+}: XYChartTypesProps) {
+  const [isOpen, setIsOpen] = useState(false);
+
+  const {
+    services: { lens },
+  } = useKibana<ObservabilityPublicPluginsStart>();
+
+  const { data = [], loading } = useFetcher(() => lens.getXyVisTypes(), [lens]);
+
+  let vizTypes = data ?? [];
+
+  if ((excludeChartTypes ?? []).length > 0) {
+    vizTypes = vizTypes.filter(({ id }) => !excludeChartTypes?.includes(id));
+  }
+
+  if ((includeChartTypes ?? []).length > 0) {
+    vizTypes = vizTypes.filter(({ id }) => includeChartTypes?.includes(id));
+  }
+
+  return loading ? (
+    <EuiLoadingSpinner />
+  ) : (
+    <EuiPopover
+      isOpen={isOpen}
+      anchorPosition="downCenter"
+      button={
+        label ? (
+          <EuiButton
+            size="s"
+            color="text"
+            iconType={vizTypes.find(({ id }) => id === value)?.icon}
+            onClick={() => {
+              setIsOpen((prevState) => !prevState);
+            }}
+          >
+            {label}
+          </EuiButton>
+        ) : (
+          <EuiButtonIcon
+            aria-label={vizTypes.find(({ id }) => id === value)?.label}
+            iconType={vizTypes.find(({ id }) => id === value)?.icon!}
+            onClick={() => {
+              setIsOpen((prevState) => !prevState);
+            }}
+          />
+        )
+      }
+      closePopover={() => setIsOpen(false)}
+    >
+      <ButtonGroup
+        isIconOnly
+        buttonSize="m"
+        legend={i18n.translate('xpack.observability.xyChart.chartTypeLegend', {
+          defaultMessage: 'Chart type',
+        })}
+        name="chartType"
+        className="eui-displayInlineBlock"
+        options={vizTypes.map((t) => ({
+          id: t.id,
+          label: t.label,
+          title: t.label,
+          iconType: t.icon || 'empty',
+          'data-test-subj': `lnsXY_seriesType-${t.id}`,
+        }))}
+        idSelected={value}
+        onChange={(valueN: string) => {
+          onChange(valueN as SeriesType);
+        }}
+      />
+    </EuiPopover>
+  );
+}
+
+const ButtonGroup = styled(EuiButtonGroup)`
+  &&& {
+    .euiButtonGroupButton-isSelected {
+      background-color: #a5a9b1 !important;
+    }
+  }
+`;
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/date_picker_col.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/date_picker_col.tsx
new file mode 100644
index 0000000000000..8c99de51978a7
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/date_picker_col.tsx
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { SeriesDatePicker } from '../../series_date_picker';
+
+interface Props {
+  seriesId: string;
+}
+export function DatePickerCol({ seriesId }: Props) {
+  return (
+    <div style={{ maxWidth: 300 }}>
+      <SeriesDatePicker seriesId={seriesId} />
+    </div>
+  );
+}
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/filter_expanded.test.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/filter_expanded.test.tsx
new file mode 100644
index 0000000000000..edd5546f13940
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/filter_expanded.test.tsx
@@ -0,0 +1,93 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { fireEvent, screen } from '@testing-library/react';
+import { FilterExpanded } from './filter_expanded';
+import { mockUrlStorage, mockUseValuesList, render } from '../../rtl_helpers';
+import { USER_AGENT_NAME } from '../../configurations/data/elasticsearch_fieldnames';
+
+describe('FilterExpanded', function () {
+  it('should render properly', async function () {
+    mockUrlStorage({ filters: [{ field: USER_AGENT_NAME, values: ['Chrome'] }] });
+
+    render(
+      <FilterExpanded
+        seriesId={'series-id'}
+        label={'Browser Family'}
+        field={USER_AGENT_NAME}
+        goBack={jest.fn()}
+      />
+    );
+
+    screen.getByText('Browser Family');
+  });
+  it('should call go back on click', async function () {
+    mockUrlStorage({ filters: [{ field: USER_AGENT_NAME, values: ['Chrome'] }] });
+    const goBack = jest.fn();
+
+    render(
+      <FilterExpanded
+        seriesId={'series-id'}
+        label={'Browser Family'}
+        field={USER_AGENT_NAME}
+        goBack={goBack}
+      />
+    );
+
+    fireEvent.click(screen.getByText('Browser Family'));
+
+    expect(goBack).toHaveBeenCalledTimes(1);
+    expect(goBack).toHaveBeenCalledWith();
+  });
+
+  it('should call useValuesList on load', async function () {
+    mockUrlStorage({ filters: [{ field: USER_AGENT_NAME, values: ['Chrome'] }] });
+
+    const { spy } = mockUseValuesList(['Chrome', 'Firefox']);
+
+    const goBack = jest.fn();
+
+    render(
+      <FilterExpanded
+        seriesId={'series-id'}
+        label={'Browser Family'}
+        field={USER_AGENT_NAME}
+        goBack={goBack}
+      />
+    );
+
+    expect(spy).toHaveBeenCalledTimes(1);
+    expect(spy).toBeCalledWith(
+      expect.objectContaining({
+        time: { from: 'now-15m', to: 'now' },
+        sourceField: USER_AGENT_NAME,
+      })
+    );
+  });
+  it('should filter display values', async function () {
+    mockUrlStorage({ filters: [{ field: USER_AGENT_NAME, values: ['Chrome'] }] });
+
+    mockUseValuesList(['Chrome', 'Firefox']);
+
+    render(
+      <FilterExpanded
+        seriesId={'series-id'}
+        label={'Browser Family'}
+        field={USER_AGENT_NAME}
+        goBack={jest.fn()}
+      />
+    );
+
+    expect(screen.queryByText('Firefox')).toBeTruthy();
+
+    fireEvent.input(screen.getByRole('searchbox'), { target: { value: 'ch' } });
+
+    expect(screen.queryByText('Firefox')).toBeFalsy();
+    expect(screen.getByText('Chrome')).toBeTruthy();
+  });
+});
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/filter_expanded.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/filter_expanded.tsx
new file mode 100644
index 0000000000000..280912dd0902f
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/filter_expanded.tsx
@@ -0,0 +1,100 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useState, Fragment } from 'react';
+import {
+  EuiFieldSearch,
+  EuiSpacer,
+  EuiButtonEmpty,
+  EuiLoadingSpinner,
+  EuiFilterGroup,
+} from '@elastic/eui';
+import { useIndexPatternContext } from '../../hooks/use_default_index_pattern';
+import { useUrlStorage } from '../../hooks/use_url_strorage';
+import { UrlFilter } from '../../types';
+import { FilterValueButton } from './filter_value_btn';
+import { useValuesList } from '../../../../../hooks/use_values_list';
+
+interface Props {
+  seriesId: string;
+  label: string;
+  field: string;
+  goBack: () => void;
+  nestedField?: string;
+}
+
+export function FilterExpanded({ seriesId, field, label, goBack, nestedField }: Props) {
+  const { indexPattern } = useIndexPatternContext();
+
+  const [value, setValue] = useState('');
+
+  const [isOpen, setIsOpen] = useState({ value: '', negate: false });
+
+  const { series } = useUrlStorage(seriesId);
+
+  const { values, loading } = useValuesList({
+    sourceField: field,
+    time: series.time,
+    indexPattern,
+  });
+
+  const filters = series?.filters ?? [];
+
+  const currFilter: UrlFilter | undefined = filters.find(({ field: fd }) => field === fd);
+
+  const displayValues = (values || []).filter((opt) =>
+    opt.toLowerCase().includes(value.toLowerCase())
+  );
+
+  return (
+    <>
+      <EuiButtonEmpty iconType="arrowLeft" color="text" onClick={() => goBack()}>
+        {label}
+      </EuiButtonEmpty>
+      <EuiFieldSearch
+        fullWidth
+        value={value}
+        onChange={(evt) => {
+          setValue(evt.target.value);
+        }}
+      />
+      <EuiSpacer size="s" />
+      {loading && (
+        <div style={{ textAlign: 'center' }}>
+          <EuiLoadingSpinner />
+        </div>
+      )}
+      {displayValues.map((opt) => (
+        <Fragment key={opt}>
+          <EuiFilterGroup fullWidth={true} color="primary">
+            <FilterValueButton
+              field={field}
+              value={opt}
+              allSelectedValues={currFilter?.notValues}
+              negate={true}
+              nestedField={nestedField}
+              seriesId={seriesId}
+              isNestedOpen={isOpen}
+              setIsNestedOpen={setIsOpen}
+            />
+            <FilterValueButton
+              field={field}
+              value={opt}
+              allSelectedValues={currFilter?.values}
+              nestedField={nestedField}
+              seriesId={seriesId}
+              negate={false}
+              isNestedOpen={isOpen}
+              setIsNestedOpen={setIsOpen}
+            />
+          </EuiFilterGroup>
+          <EuiSpacer size="s" />
+        </Fragment>
+      ))}
+    </>
+  );
+}
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/filter_value_btn.test.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/filter_value_btn.test.tsx
new file mode 100644
index 0000000000000..7f76c9ea999ee
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/filter_value_btn.test.tsx
@@ -0,0 +1,238 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { fireEvent, screen } from '@testing-library/react';
+import { FilterValueButton } from './filter_value_btn';
+import { mockUrlStorage, mockUseSeriesFilter, mockUseValuesList, render } from '../../rtl_helpers';
+import {
+  USER_AGENT_NAME,
+  USER_AGENT_VERSION,
+} from '../../configurations/data/elasticsearch_fieldnames';
+
+describe('FilterValueButton', function () {
+  it('should render properly', async function () {
+    render(
+      <FilterValueButton
+        field={USER_AGENT_NAME}
+        seriesId={'series-id'}
+        value={'Chrome'}
+        isNestedOpen={{ value: '', negate: false }}
+        setIsNestedOpen={jest.fn()}
+        negate={false}
+      />
+    );
+
+    screen.getByText('Chrome');
+  });
+
+  it('should render display negate state', async function () {
+    render(
+      <FilterValueButton
+        field={USER_AGENT_NAME}
+        seriesId={'series-id'}
+        value={'Chrome'}
+        isNestedOpen={{ value: '', negate: false }}
+        setIsNestedOpen={jest.fn()}
+        negate={true}
+      />
+    );
+
+    screen.getByText('Not Chrome');
+    screen.getByTitle('Not Chrome');
+    const btn = screen.getByRole('button');
+    expect(btn.classList).toContain('euiButtonEmpty--danger');
+  });
+
+  it('should call set filter on click', async function () {
+    const { setFilter, removeFilter } = mockUseSeriesFilter();
+
+    render(
+      <FilterValueButton
+        field={USER_AGENT_NAME}
+        seriesId={'series-id'}
+        value={'Chrome'}
+        isNestedOpen={{ value: '', negate: false }}
+        setIsNestedOpen={jest.fn()}
+        negate={true}
+        allSelectedValues={['Firefox']}
+      />
+    );
+
+    fireEvent.click(screen.getByText('Not Chrome'));
+
+    expect(removeFilter).toHaveBeenCalledTimes(0);
+    expect(setFilter).toHaveBeenCalledTimes(1);
+
+    expect(setFilter).toHaveBeenCalledWith({
+      field: 'user_agent.name',
+      negate: true,
+      value: 'Chrome',
+    });
+  });
+  it('should remove filter on click if already selected', async function () {
+    mockUrlStorage({});
+    const { removeFilter } = mockUseSeriesFilter();
+
+    render(
+      <FilterValueButton
+        field={USER_AGENT_NAME}
+        seriesId={'series-id'}
+        value={'Chrome'}
+        isNestedOpen={{ value: '', negate: false }}
+        setIsNestedOpen={jest.fn()}
+        negate={false}
+        allSelectedValues={['Chrome', 'Firefox']}
+      />
+    );
+
+    fireEvent.click(screen.getByText('Chrome'));
+
+    expect(removeFilter).toHaveBeenCalledWith({
+      field: 'user_agent.name',
+      negate: false,
+      value: 'Chrome',
+    });
+  });
+
+  it('should change filter on negated one', async function () {
+    const { removeFilter } = mockUseSeriesFilter();
+
+    render(
+      <FilterValueButton
+        field={USER_AGENT_NAME}
+        seriesId={'series-id'}
+        value={'Chrome'}
+        isNestedOpen={{ value: '', negate: false }}
+        setIsNestedOpen={jest.fn()}
+        negate={true}
+        allSelectedValues={['Chrome', 'Firefox']}
+      />
+    );
+
+    fireEvent.click(screen.getByText('Not Chrome'));
+
+    expect(removeFilter).toHaveBeenCalledWith({
+      field: 'user_agent.name',
+      negate: true,
+      value: 'Chrome',
+    });
+  });
+
+  it('should force open nested', async function () {
+    mockUseSeriesFilter();
+    const { spy } = mockUseValuesList();
+
+    render(
+      <FilterValueButton
+        field={USER_AGENT_NAME}
+        seriesId={'series-id'}
+        value={'Chrome'}
+        isNestedOpen={{ value: 'Chrome', negate: false }}
+        setIsNestedOpen={jest.fn()}
+        negate={false}
+        allSelectedValues={['Chrome', 'Firefox']}
+        nestedField={USER_AGENT_VERSION}
+      />
+    );
+
+    expect(spy).toHaveBeenCalledTimes(1);
+    expect(spy).toBeCalledWith(
+      expect.objectContaining({
+        filters: [
+          {
+            term: {
+              [USER_AGENT_NAME]: 'Chrome',
+            },
+          },
+        ],
+        sourceField: 'user_agent.version',
+      })
+    );
+  });
+  it('should set isNestedOpen on click', async function () {
+    mockUseSeriesFilter();
+    const { spy } = mockUseValuesList();
+
+    render(
+      <FilterValueButton
+        field={USER_AGENT_NAME}
+        seriesId={'series-id'}
+        value={'Chrome'}
+        isNestedOpen={{ value: 'Chrome', negate: false }}
+        setIsNestedOpen={jest.fn()}
+        negate={false}
+        allSelectedValues={['Chrome', 'Firefox']}
+        nestedField={USER_AGENT_VERSION}
+      />
+    );
+
+    expect(spy).toHaveBeenCalledTimes(2);
+    expect(spy).toBeCalledWith(
+      expect.objectContaining({
+        filters: [
+          {
+            term: {
+              [USER_AGENT_NAME]: 'Chrome',
+            },
+          },
+        ],
+        sourceField: USER_AGENT_VERSION,
+      })
+    );
+  });
+
+  it('should set call setIsNestedOpen on click selected', async function () {
+    mockUseSeriesFilter();
+    mockUseValuesList();
+
+    const setIsNestedOpen = jest.fn();
+
+    render(
+      <FilterValueButton
+        field={USER_AGENT_NAME}
+        seriesId={'series-id'}
+        value={'Chrome'}
+        isNestedOpen={{ value: '', negate: false }}
+        setIsNestedOpen={setIsNestedOpen}
+        negate={false}
+        allSelectedValues={['Chrome', 'Firefox']}
+        nestedField={USER_AGENT_VERSION}
+      />
+    );
+
+    fireEvent.click(screen.getByText('Chrome'));
+
+    expect(setIsNestedOpen).toHaveBeenCalledTimes(1);
+    expect(setIsNestedOpen).toHaveBeenCalledWith({ negate: false, value: '' });
+  });
+
+  it('should set call setIsNestedOpen on click not selected', async function () {
+    mockUseSeriesFilter();
+    mockUseValuesList();
+
+    const setIsNestedOpen = jest.fn();
+
+    render(
+      <FilterValueButton
+        field={USER_AGENT_NAME}
+        seriesId={'series-id'}
+        value={'Chrome'}
+        isNestedOpen={{ value: '', negate: true }}
+        setIsNestedOpen={setIsNestedOpen}
+        negate={true}
+        allSelectedValues={['Firefox']}
+        nestedField={USER_AGENT_VERSION}
+      />
+    );
+
+    fireEvent.click(screen.getByText('Not Chrome'));
+
+    expect(setIsNestedOpen).toHaveBeenCalledTimes(1);
+    expect(setIsNestedOpen).toHaveBeenCalledWith({ negate: true, value: 'Chrome' });
+  });
+});
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/filter_value_btn.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/filter_value_btn.tsx
new file mode 100644
index 0000000000000..42cdfd595e66b
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/filter_value_btn.tsx
@@ -0,0 +1,117 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { i18n } from '@kbn/i18n';
+import React, { useMemo } from 'react';
+import { EuiFilterButton, hexToRgb } from '@elastic/eui';
+import { useIndexPatternContext } from '../../hooks/use_default_index_pattern';
+import { useUrlStorage } from '../../hooks/use_url_strorage';
+import { useSeriesFilters } from '../../hooks/use_series_filters';
+import { euiStyled } from '../../../../../../../../../src/plugins/kibana_react/common';
+import FieldValueSuggestions from '../../../field_value_suggestions';
+
+interface Props {
+  value: string;
+  field: string;
+  allSelectedValues?: string[];
+  negate: boolean;
+  nestedField?: string;
+  seriesId: string;
+  isNestedOpen: {
+    value: string;
+    negate: boolean;
+  };
+  setIsNestedOpen: (val: { value: string; negate: boolean }) => void;
+}
+
+export function FilterValueButton({
+  isNestedOpen,
+  setIsNestedOpen,
+  value,
+  field,
+  negate,
+  seriesId,
+  nestedField,
+  allSelectedValues,
+}: Props) {
+  const { series } = useUrlStorage(seriesId);
+
+  const { indexPattern } = useIndexPatternContext();
+
+  const { setFilter, removeFilter } = useSeriesFilters({ seriesId });
+
+  const hasActiveFilters = (allSelectedValues ?? []).includes(value);
+
+  const button = (
+    <FilterButton
+      hasActiveFilters={hasActiveFilters}
+      color={negate ? 'danger' : 'primary'}
+      onClick={() => {
+        if (hasActiveFilters) {
+          removeFilter({ field, value, negate });
+        } else {
+          setFilter({ field, value, negate });
+        }
+        if (!hasActiveFilters) {
+          setIsNestedOpen({ value, negate });
+        } else {
+          setIsNestedOpen({ value: '', negate });
+        }
+      }}
+    >
+      {negate
+        ? i18n.translate('xpack.observability.expView.filterValueButton.negate', {
+            defaultMessage: 'Not {value}',
+            values: { value },
+          })
+        : value}
+    </FilterButton>
+  );
+
+  const onNestedChange = (val?: string) => {
+    setFilter({ field: nestedField!, value: val! });
+    setIsNestedOpen({ value: '', negate });
+  };
+
+  const forceOpenNested = isNestedOpen?.value === value && isNestedOpen.negate === negate;
+
+  const filters = useMemo(() => {
+    return [
+      {
+        term: {
+          [field]: value,
+        },
+      },
+    ];
+  }, [field, value]);
+
+  return nestedField && forceOpenNested ? (
+    <FieldValueSuggestions
+      button={button}
+      label={'Version'}
+      indexPattern={indexPattern}
+      sourceField={nestedField}
+      onChange={onNestedChange}
+      filters={filters}
+      forceOpen={forceOpenNested}
+      anchorPosition="rightCenter"
+      time={series.time}
+    />
+  ) : (
+    button
+  );
+}
+
+const FilterButton = euiStyled(EuiFilterButton)`
+  background-color: rgba(${(props) => {
+    const color = props.hasActiveFilters
+      ? props.color === 'danger'
+        ? hexToRgb(props.theme.eui.euiColorDanger)
+        : hexToRgb(props.theme.eui.euiColorPrimary)
+      : 'initial';
+    return `${color[0]}, ${color[1]}, ${color[2]}, 0.1`;
+  }});
+`;
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/metric_selection.test.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/metric_selection.test.tsx
new file mode 100644
index 0000000000000..ced04f0a59c8c
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/metric_selection.test.tsx
@@ -0,0 +1,112 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { fireEvent, screen } from '@testing-library/react';
+import { mockUrlStorage, render } from '../../rtl_helpers';
+import { MetricSelection } from './metric_selection';
+
+describe('MetricSelection', function () {
+  it('should render properly', function () {
+    render(<MetricSelection seriesId={'series-id'} isDisabled={false} />);
+
+    screen.getByText('Average');
+  });
+
+  it('should display selected value', function () {
+    mockUrlStorage({
+      data: {
+        'performance-distribution': {
+          reportType: 'kpi',
+          metric: 'median',
+          time: { from: 'now-15m', to: 'now' },
+        },
+      },
+    });
+
+    render(<MetricSelection seriesId={'series-id'} isDisabled={false} />);
+
+    screen.getByText('Median');
+  });
+
+  it('should be disabled on disabled state', function () {
+    render(<MetricSelection seriesId={'series-id'} isDisabled={true} />);
+
+    const btn = screen.getByRole('button');
+
+    expect(btn.classList).toContain('euiButton-isDisabled');
+  });
+
+  it('should call set series on change', function () {
+    const { setSeries } = mockUrlStorage({
+      data: {
+        'performance-distribution': {
+          reportType: 'kpi',
+          metric: 'median',
+          time: { from: 'now-15m', to: 'now' },
+        },
+      },
+    });
+
+    render(<MetricSelection seriesId={'series-id'} isDisabled={false} />);
+
+    fireEvent.click(screen.getByText('Median'));
+
+    screen.getByText('Chart metric group');
+
+    fireEvent.click(screen.getByText('95th Percentile'));
+
+    expect(setSeries).toHaveBeenNthCalledWith(1, 'performance-distribution', {
+      metric: '95th',
+      reportType: 'kpi',
+      time: { from: 'now-15m', to: 'now' },
+    });
+    // FIXME This is a bug in EUI EuiButtonGroup calls on change multiple times
+    // This should be one https://github.com/elastic/eui/issues/4629
+    expect(setSeries).toHaveBeenCalledTimes(3);
+  });
+
+  it('should call set series on change for all series', function () {
+    const { setSeries } = mockUrlStorage({
+      data: {
+        'page-views': {
+          reportType: 'kpi',
+          metric: 'median',
+          time: { from: 'now-15m', to: 'now' },
+        },
+        'performance-distribution': {
+          reportType: 'kpi',
+          metric: 'median',
+          time: { from: 'now-15m', to: 'now' },
+        },
+      },
+    });
+
+    render(<MetricSelection seriesId={'series-id'} isDisabled={false} />);
+
+    fireEvent.click(screen.getByText('Median'));
+
+    screen.getByText('Chart metric group');
+
+    fireEvent.click(screen.getByText('95th Percentile'));
+
+    expect(setSeries).toHaveBeenNthCalledWith(1, 'page-views', {
+      metric: '95th',
+      reportType: 'kpi',
+      time: { from: 'now-15m', to: 'now' },
+    });
+
+    expect(setSeries).toHaveBeenNthCalledWith(2, 'performance-distribution', {
+      metric: '95th',
+      reportType: 'kpi',
+      time: { from: 'now-15m', to: 'now' },
+    });
+    // FIXME This is a bug in EUI EuiButtonGroup calls on change multiple times
+    // This should be one https://github.com/elastic/eui/issues/4629
+    expect(setSeries).toHaveBeenCalledTimes(6);
+  });
+});
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/metric_selection.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/metric_selection.tsx
new file mode 100644
index 0000000000000..e01e371b5eeeb
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/metric_selection.tsx
@@ -0,0 +1,86 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useState } from 'react';
+import { i18n } from '@kbn/i18n';
+import { EuiButton, EuiButtonGroup, EuiPopover } from '@elastic/eui';
+import { useUrlStorage } from '../../hooks/use_url_strorage';
+import { OperationType } from '../../../../../../../lens/public';
+
+const toggleButtons = [
+  {
+    id: `avg`,
+    label: i18n.translate('xpack.observability.expView.metricsSelect.average', {
+      defaultMessage: 'Average',
+    }),
+  },
+  {
+    id: `median`,
+    label: i18n.translate('xpack.observability.expView.metricsSelect.median', {
+      defaultMessage: 'Median',
+    }),
+  },
+  {
+    id: `95th`,
+    label: i18n.translate('xpack.observability.expView.metricsSelect.9thPercentile', {
+      defaultMessage: '95th Percentile',
+    }),
+  },
+  {
+    id: `99th`,
+    label: i18n.translate('xpack.observability.expView.metricsSelect.99thPercentile', {
+      defaultMessage: '99th Percentile',
+    }),
+  },
+];
+
+export function MetricSelection({
+  seriesId,
+  isDisabled,
+}: {
+  seriesId: string;
+  isDisabled: boolean;
+}) {
+  const { series, setSeries, allSeries } = useUrlStorage(seriesId);
+
+  const [isOpen, setIsOpen] = useState(false);
+
+  const [toggleIdSelected, setToggleIdSelected] = useState(series?.metric ?? 'avg');
+
+  const onChange = (optionId: OperationType) => {
+    setToggleIdSelected(optionId);
+
+    Object.keys(allSeries).forEach((seriesKey) => {
+      const seriesN = allSeries[seriesKey];
+
+      setSeries(seriesKey, { ...seriesN, metric: optionId });
+    });
+  };
+  const button = (
+    <EuiButton
+      onClick={() => setIsOpen((prevState) => !prevState)}
+      size="s"
+      color="text"
+      isDisabled={isDisabled}
+    >
+      {toggleButtons.find(({ id }) => id === toggleIdSelected)!.label}
+    </EuiButton>
+  );
+
+  return (
+    <EuiPopover button={button} isOpen={isOpen} closePopover={() => setIsOpen(false)}>
+      <EuiButtonGroup
+        buttonSize="m"
+        color="primary"
+        legend="Chart metric group"
+        options={toggleButtons}
+        idSelected={toggleIdSelected}
+        onChange={(id) => onChange(id as OperationType)}
+      />
+    </EuiPopover>
+  );
+}
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/remove_series.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/remove_series.tsx
new file mode 100644
index 0000000000000..67aebed943326
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/remove_series.tsx
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+import React from 'react';
+import { EuiButtonIcon } from '@elastic/eui';
+import { DataSeries } from '../../types';
+import { useUrlStorage } from '../../hooks/use_url_strorage';
+
+interface Props {
+  series: DataSeries;
+}
+
+export function RemoveSeries({ series }: Props) {
+  const { removeSeries } = useUrlStorage();
+
+  const onClick = () => {
+    removeSeries(series.id);
+  };
+  return (
+    <EuiButtonIcon
+      aria-label={i18n.translate('xpack.observability.expView.seriesEditor.removeSeries', {
+        defaultMessage: 'Click to remove series',
+      })}
+      iconType="cross"
+      color="primary"
+      onClick={onClick}
+      size="m"
+    />
+  );
+}
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/series_filter.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/series_filter.tsx
new file mode 100644
index 0000000000000..24b65d2adb38e
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/series_filter.tsx
@@ -0,0 +1,139 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+import React, { useState, Fragment } from 'react';
+import {
+  EuiButton,
+  EuiPopover,
+  EuiSpacer,
+  EuiButtonEmpty,
+  EuiFlexItem,
+  EuiFlexGroup,
+} from '@elastic/eui';
+import { FilterExpanded } from './filter_expanded';
+import { DataSeries } from '../../types';
+import { FieldLabels } from '../../configurations/constants';
+import { SelectedFilters } from '../selected_filters';
+import { NEW_SERIES_KEY, useUrlStorage } from '../../hooks/use_url_strorage';
+
+interface Props {
+  seriesId: string;
+  defaultFilters: DataSeries['defaultFilters'];
+  series: DataSeries;
+  isNew?: boolean;
+}
+
+export interface Field {
+  label: string;
+  field: string;
+  nested?: string;
+}
+
+export function SeriesFilter({ series, isNew, seriesId, defaultFilters = [] }: Props) {
+  const [isPopoverVisible, setIsPopoverVisible] = useState(false);
+
+  const [selectedField, setSelectedField] = useState<Field | undefined>();
+
+  const options = defaultFilters.map((field) => {
+    if (typeof field === 'string') {
+      return { label: FieldLabels[field], field };
+    }
+    return { label: FieldLabels[field.field], field: field.field, nested: field.nested };
+  });
+  const disabled = seriesId === NEW_SERIES_KEY && !isNew;
+
+  const { setSeries, series: urlSeries } = useUrlStorage(seriesId);
+
+  const button = (
+    <EuiButtonEmpty
+      flush="left"
+      iconType="plus"
+      onClick={() => {
+        setIsPopoverVisible(true);
+      }}
+      isDisabled={disabled}
+      size="s"
+    >
+      {i18n.translate('xpack.observability.expView.seriesEditor.addFilter', {
+        defaultMessage: 'Add filter',
+      })}
+    </EuiButtonEmpty>
+  );
+
+  const mainPanel = (
+    <>
+      <EuiSpacer size="s" />
+      {options.map((opt) => (
+        <Fragment key={opt.label}>
+          <EuiButton
+            fullWidth={true}
+            iconType="arrowRight"
+            iconSide="right"
+            onClick={() => {
+              setSelectedField(opt);
+            }}
+          >
+            {opt.label}
+          </EuiButton>
+          <EuiSpacer size="s" />
+        </Fragment>
+      ))}
+    </>
+  );
+
+  const childPanel = selectedField ? (
+    <FilterExpanded
+      seriesId={seriesId}
+      field={selectedField.field}
+      label={selectedField.label}
+      nestedField={selectedField.nested}
+      goBack={() => {
+        setSelectedField(undefined);
+      }}
+    />
+  ) : null;
+
+  const closePopover = () => {
+    setIsPopoverVisible(false);
+    setSelectedField(undefined);
+  };
+
+  return (
+    <EuiFlexGroup wrap direction="column" gutterSize="xs" alignItems="flexStart">
+      {!disabled && <SelectedFilters seriesId={seriesId} series={series} isNew={isNew} />}
+      <EuiFlexItem grow={false}>
+        <EuiPopover
+          button={button}
+          isOpen={isPopoverVisible}
+          closePopover={closePopover}
+          anchorPosition="leftCenter"
+        >
+          {!selectedField ? mainPanel : childPanel}
+        </EuiPopover>
+      </EuiFlexItem>
+      {(urlSeries.filters ?? []).length > 0 && (
+        <EuiFlexItem grow={false}>
+          <EuiButtonEmpty
+            flush="left"
+            color="text"
+            iconType="cross"
+            onClick={() => {
+              setSeries(seriesId, { ...urlSeries, filters: undefined });
+            }}
+            isDisabled={disabled}
+            size="s"
+          >
+            {i18n.translate('xpack.observability.expView.seriesEditor.clearFilter', {
+              defaultMessage: 'Clear filters',
+            })}
+          </EuiButtonEmpty>
+        </EuiFlexItem>
+      )}
+    </EuiFlexGroup>
+  );
+}
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/selected_filters.test.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/selected_filters.test.tsx
new file mode 100644
index 0000000000000..5770a7e209f06
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/selected_filters.test.tsx
@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { screen, waitFor } from '@testing-library/react';
+import { mockIndexPattern, mockUrlStorage, render } from '../rtl_helpers';
+import { SelectedFilters } from './selected_filters';
+import { getDefaultConfigs } from '../configurations/default_configs';
+import { NEW_SERIES_KEY } from '../hooks/use_url_strorage';
+import { USER_AGENT_NAME } from '../configurations/data/elasticsearch_fieldnames';
+
+describe('SelectedFilters', function () {
+  const dataViewSeries = getDefaultConfigs({
+    reportType: 'pld',
+    indexPattern: mockIndexPattern,
+    seriesId: NEW_SERIES_KEY,
+  });
+
+  it('should render properly', async function () {
+    mockUrlStorage({ filters: [{ field: USER_AGENT_NAME, values: ['Chrome'] }] });
+
+    render(<SelectedFilters seriesId={'series-id'} series={dataViewSeries} />);
+
+    await waitFor(() => {
+      screen.getByText('Chrome');
+      screen.getByTitle('Filter: Browser family: Chrome. Select for more filter actions.');
+    });
+  });
+});
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/selected_filters.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/selected_filters.tsx
new file mode 100644
index 0000000000000..be8b1feb4d723
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/selected_filters.tsx
@@ -0,0 +1,96 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { Fragment } from 'react';
+import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import { NEW_SERIES_KEY, useUrlStorage } from '../hooks/use_url_strorage';
+import { FilterLabel } from '../components/filter_label';
+import { DataSeries, UrlFilter } from '../types';
+import { useIndexPatternContext } from '../hooks/use_default_index_pattern';
+import { useSeriesFilters } from '../hooks/use_series_filters';
+import { getFiltersFromDefs } from '../hooks/use_lens_attributes';
+
+interface Props {
+  seriesId: string;
+  series: DataSeries;
+  isNew?: boolean;
+}
+export function SelectedFilters({ seriesId, isNew, series: dataSeries }: Props) {
+  const { series } = useUrlStorage(seriesId);
+
+  const { reportDefinitions = {} } = series;
+
+  const { labels } = dataSeries;
+
+  const filters: UrlFilter[] = series.filters ?? [];
+
+  let definitionFilters: UrlFilter[] = getFiltersFromDefs(reportDefinitions, dataSeries);
+
+  // we don't want to display report definition filters in new series view
+  if (seriesId === NEW_SERIES_KEY && isNew) {
+    definitionFilters = [];
+  }
+
+  const { removeFilter } = useSeriesFilters({ seriesId });
+
+  const { indexPattern } = useIndexPatternContext();
+
+  return (filters.length > 0 || definitionFilters.length > 0) && indexPattern ? (
+    <EuiFlexItem>
+      <EuiFlexGroup wrap gutterSize="xs">
+        {filters.map(({ field, values, notValues }) => (
+          <Fragment key={field}>
+            {(values ?? []).map((val) => (
+              <EuiFlexItem key={field + val} grow={false}>
+                <FilterLabel
+                  seriesId={seriesId}
+                  field={field}
+                  label={labels[field]}
+                  value={val}
+                  removeFilter={() => removeFilter({ field, value: val, negate: false })}
+                  negate={false}
+                />
+              </EuiFlexItem>
+            ))}
+            {(notValues ?? []).map((val) => (
+              <EuiFlexItem key={field + val} grow={false}>
+                <FilterLabel
+                  seriesId={seriesId}
+                  field={field}
+                  label={labels[field]}
+                  value={val}
+                  negate={true}
+                  removeFilter={() => removeFilter({ field, value: val, negate: true })}
+                />
+              </EuiFlexItem>
+            ))}
+          </Fragment>
+        ))}
+
+        {definitionFilters.map(({ field, values }) => (
+          <Fragment key={field}>
+            {(values ?? []).map((val) => (
+              <EuiFlexItem key={field + val} grow={false}>
+                <FilterLabel
+                  seriesId={seriesId}
+                  field={field}
+                  label={labels[field]}
+                  value={val}
+                  removeFilter={() => {
+                    // FIXME handle this use case
+                  }}
+                  negate={false}
+                  definitionFilter={true}
+                />
+              </EuiFlexItem>
+            ))}
+          </Fragment>
+        ))}
+      </EuiFlexGroup>
+    </EuiFlexItem>
+  ) : null;
+}
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/series_editor.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/series_editor.tsx
new file mode 100644
index 0000000000000..2d423c9aee3fc
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/series_editor.tsx
@@ -0,0 +1,139 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { i18n } from '@kbn/i18n';
+import { EuiBasicTable, EuiIcon, EuiSpacer, EuiText } from '@elastic/eui';
+import { SeriesFilter } from './columns/series_filter';
+import { ActionsCol } from './columns/actions_col';
+import { Breakdowns } from './columns/breakdowns';
+import { DataSeries } from '../types';
+import { SeriesBuilder } from '../series_builder/series_builder';
+import { NEW_SERIES_KEY, useUrlStorage } from '../hooks/use_url_strorage';
+import { getDefaultConfigs } from '../configurations/default_configs';
+import { DatePickerCol } from './columns/date_picker_col';
+import { RemoveSeries } from './columns/remove_series';
+import { useIndexPatternContext } from '../hooks/use_default_index_pattern';
+
+export function SeriesEditor() {
+  const { allSeries, firstSeriesId } = useUrlStorage();
+
+  const columns = [
+    {
+      name: i18n.translate('xpack.observability.expView.seriesEditor.name', {
+        defaultMessage: 'Name',
+      }),
+      field: 'id',
+      width: '15%',
+      render: (val: string) => (
+        <EuiText>
+          <EuiIcon type="dot" color="green" size="l" />{' '}
+          {val === NEW_SERIES_KEY ? 'new-series-preview' : val}
+        </EuiText>
+      ),
+    },
+    ...(firstSeriesId !== NEW_SERIES_KEY
+      ? [
+          {
+            name: i18n.translate('xpack.observability.expView.seriesEditor.filters', {
+              defaultMessage: 'Filters',
+            }),
+            field: 'defaultFilters',
+            width: '25%',
+            render: (defaultFilters: string[], series: DataSeries) => (
+              <SeriesFilter defaultFilters={defaultFilters} seriesId={series.id} series={series} />
+            ),
+          },
+          {
+            name: i18n.translate('xpack.observability.expView.seriesEditor.breakdowns', {
+              defaultMessage: 'Breakdowns',
+            }),
+            field: 'breakdowns',
+            width: '15%',
+            render: (val: string[], item: DataSeries) => (
+              <Breakdowns seriesId={item.id} breakdowns={val} />
+            ),
+          },
+          {
+            name: '',
+            align: 'center' as const,
+            width: '15%',
+            field: 'id',
+            render: (val: string, item: DataSeries) => <ActionsCol series={item} />,
+          },
+        ]
+      : []),
+    {
+      name: (
+        <div>
+          {i18n.translate('xpack.observability.expView.seriesEditor.time', {
+            defaultMessage: 'Time',
+          })}
+        </div>
+      ),
+      width: '20%',
+      field: 'id',
+      align: 'right' as const,
+      render: (val: string, item: DataSeries) => <DatePickerCol seriesId={item.id} />,
+    },
+
+    ...(firstSeriesId !== NEW_SERIES_KEY
+      ? [
+          {
+            name: i18n.translate('xpack.observability.expView.seriesEditor.actions', {
+              defaultMessage: 'Actions',
+            }),
+            align: 'center' as const,
+            width: '5%',
+            field: 'id',
+            render: (val: string, item: DataSeries) => <RemoveSeries series={item} />,
+          },
+        ]
+      : []),
+  ];
+
+  const allSeriesKeys = Object.keys(allSeries);
+
+  const items: DataSeries[] = [];
+
+  const { indexPattern } = useIndexPatternContext();
+
+  allSeriesKeys.forEach((seriesKey) => {
+    const series = allSeries[seriesKey];
+    if (series.reportType && indexPattern) {
+      items.push(
+        getDefaultConfigs({
+          indexPattern,
+          reportType: series.reportType,
+          seriesId: seriesKey,
+        })
+      );
+    }
+  });
+
+  return (
+    <>
+      <EuiSpacer />
+      <EuiBasicTable
+        items={items}
+        rowHeader="firstName"
+        columns={columns}
+        rowProps={() => (firstSeriesId === NEW_SERIES_KEY ? {} : { height: 100 })}
+        noItemsMessage={i18n.translate('xpack.observability.expView.seriesEditor.notFound', {
+          defaultMessage: 'No series found, please add a series.',
+        })}
+        cellProps={{
+          style: {
+            verticalAlign: 'top',
+          },
+        }}
+      />
+      <EuiSpacer />
+      <SeriesBuilder />
+    </>
+  );
+}
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/types.ts b/x-pack/plugins/observability/public/components/shared/exploratory_view/types.ts
new file mode 100644
index 0000000000000..444e0ddaecb4a
--- /dev/null
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/types.ts
@@ -0,0 +1,89 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { PaletteOutput } from 'src/plugins/charts/public';
+import {
+  LastValueIndexPatternColumn,
+  DateHistogramIndexPatternColumn,
+  SeriesType,
+  OperationType,
+  IndexPatternColumn,
+} from '../../../../../lens/public';
+
+import { PersistableFilter } from '../../../../../lens/common';
+import { IIndexPattern } from '../../../../../../../src/plugins/data/common/index_patterns';
+
+export const ReportViewTypes = {
+  pld: 'page-load-dist',
+  kpi: 'kpi-trends',
+  upd: 'uptime-duration',
+  upp: 'uptime-pings',
+  svl: 'service-latency',
+  tpt: 'service-throughput',
+  logs: 'logs-frequency',
+  cpu: 'cpu-usage',
+  mem: 'memory-usage',
+  nwk: 'network-activity',
+} as const;
+
+type ValueOf<T> = T[keyof T];
+
+export type ReportViewTypeId = keyof typeof ReportViewTypes;
+
+export type ReportViewType = ValueOf<typeof ReportViewTypes>;
+
+export interface ReportDefinition {
+  field: string;
+  required?: boolean;
+  custom?: boolean;
+  defaultValue?: string;
+  options?: Array<{ field: string; label: string; description?: string }>;
+}
+
+export interface DataSeries {
+  reportType: ReportViewType;
+  id: string;
+  xAxisColumn: Partial<LastValueIndexPatternColumn> | Partial<DateHistogramIndexPatternColumn>;
+  yAxisColumn: Partial<IndexPatternColumn>;
+
+  breakdowns: string[];
+  defaultSeriesType: SeriesType;
+  defaultFilters: Array<string | { field: string; nested: string }>;
+  seriesTypes: SeriesType[];
+  filters?: PersistableFilter[];
+  reportDefinitions: ReportDefinition[];
+  labels: Record<string, string>;
+  hasMetricType: boolean;
+  palette?: PaletteOutput;
+}
+
+export interface SeriesUrl {
+  time: {
+    to: string;
+    from: string;
+  };
+  breakdown?: string;
+  filters?: UrlFilter[];
+  seriesType?: SeriesType;
+  reportType: ReportViewTypeId;
+  metric?: OperationType;
+  dataType?: AppDataType;
+  reportDefinitions?: Record<string, string>;
+}
+
+export interface UrlFilter {
+  field: string;
+  values?: string[];
+  notValues?: string[];
+}
+
+export interface ConfigProps {
+  seriesId: string;
+  indexPattern: IIndexPattern;
+}
+
+export type AppDataType = 'synthetics' | 'rum' | 'logs' | 'metrics' | 'apm';
diff --git a/x-pack/plugins/observability/public/components/shared/field_value_suggestions/field_value_selection.tsx b/x-pack/plugins/observability/public/components/shared/field_value_suggestions/field_value_selection.tsx
index b2c682dc58937..a44aab2da85be 100644
--- a/x-pack/plugins/observability/public/components/shared/field_value_suggestions/field_value_selection.tsx
+++ b/x-pack/plugins/observability/public/components/shared/field_value_suggestions/field_value_selection.tsx
@@ -15,14 +15,19 @@ import {
   EuiSelectableOption,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
+import { PopoverAnchorPosition } from '@elastic/eui/src/components/popover/popover';
 
 export interface FieldValueSelectionProps {
   value?: string;
   label: string;
-  loading: boolean;
+  loading?: boolean;
   onChange: (val?: string) => void;
   values?: string[];
   setQuery: Dispatch<SetStateAction<string>>;
+  anchorPosition?: PopoverAnchorPosition;
+  forceOpen?: boolean;
+  button?: JSX.Element;
+  width?: number;
 }
 
 const formatOptions = (values?: string[], value?: string): EuiSelectableOption[] => {
@@ -38,6 +43,10 @@ export function FieldValueSelection({
   loading,
   values,
   setQuery,
+  button,
+  width,
+  forceOpen,
+  anchorPosition,
   onChange: onSelectionChange,
 }: FieldValueSelectionProps) {
   const [options, setOptions] = useState<EuiSelectableOption[]>(formatOptions(values, value));
@@ -63,8 +72,9 @@ export function FieldValueSelection({
     setQuery((evt.target as HTMLInputElement).value);
   };
 
-  const button = (
+  const anchorButton = (
     <EuiButton
+      style={width ? { width } : {}}
       size="s"
       iconType="arrowDown"
       iconSide="right"
@@ -80,9 +90,10 @@ export function FieldValueSelection({
       <EuiPopover
         id="popover"
         panelPaddingSize="none"
-        button={button}
-        isOpen={isPopoverOpen}
+        button={button || anchorButton}
+        isOpen={isPopoverOpen || forceOpen}
         closePopover={closePopover}
+        anchorPosition={anchorPosition}
       >
         <EuiSelectable
           searchable
diff --git a/x-pack/plugins/observability/public/components/shared/field_value_suggestions/index.tsx b/x-pack/plugins/observability/public/components/shared/field_value_suggestions/index.tsx
index 20c37cf753a01..9ffe2584c8d75 100644
--- a/x-pack/plugins/observability/public/components/shared/field_value_suggestions/index.tsx
+++ b/x-pack/plugins/observability/public/components/shared/field_value_suggestions/index.tsx
@@ -8,16 +8,24 @@
 import React, { useState } from 'react';
 
 import { useDebounce } from 'react-use';
+import { PopoverAnchorPosition } from '@elastic/eui/src/components/popover/popover';
 import { useValuesList } from '../../../hooks/use_values_list';
-import { IIndexPattern } from '../../../../../../../src/plugins/data/common';
+import { IndexPattern } from '../../../../../../../src/plugins/data/common';
 import { FieldValueSelection } from './field_value_selection';
+import { ESFilter } from '../../../../../../../typings/elasticsearch';
 
 export interface FieldValueSuggestionsProps {
   value?: string;
   label: string;
-  indexPattern: IIndexPattern;
+  indexPattern: IndexPattern;
   sourceField: string;
   onChange: (val?: string) => void;
+  filters: ESFilter[];
+  anchorPosition?: PopoverAnchorPosition;
+  time?: { from: string; to: string };
+  forceOpen?: boolean;
+  button?: JSX.Element;
+  width?: number;
 }
 
 export function FieldValueSuggestions({
@@ -25,12 +33,18 @@ export function FieldValueSuggestions({
   label,
   indexPattern,
   value,
+  filters,
+  button,
+  time,
+  width,
+  forceOpen,
+  anchorPosition,
   onChange: onSelectionChange,
 }: FieldValueSuggestionsProps) {
   const [query, setQuery] = useState('');
   const [debouncedValue, setDebouncedValue] = useState('');
 
-  const { values, loading } = useValuesList({ indexPattern, query, sourceField });
+  const { values, loading } = useValuesList({ indexPattern, query, sourceField, filters, time });
 
   useDebounce(
     () => {
@@ -48,6 +62,10 @@ export function FieldValueSuggestions({
       setQuery={setDebouncedValue}
       loading={loading}
       value={value}
+      button={button}
+      forceOpen={forceOpen}
+      anchorPosition={anchorPosition}
+      width={width}
     />
   );
 }
diff --git a/x-pack/plugins/observability/public/context/has_data_context.test.tsx b/x-pack/plugins/observability/public/context/has_data_context.test.tsx
index 5e48860a9b049..01655c0d7b2d7 100644
--- a/x-pack/plugins/observability/public/context/has_data_context.test.tsx
+++ b/x-pack/plugins/observability/public/context/has_data_context.test.tsx
@@ -17,12 +17,19 @@ import { HasData, ObservabilityFetchDataPlugins } from '../typings/fetch_overvie
 import { HasDataContextProvider } from './has_data_context';
 import * as pluginContext from '../hooks/use_plugin_context';
 import { PluginContextValue } from './plugin_context';
+import { Router } from 'react-router-dom';
+import { createMemoryHistory } from 'history';
 
 const relativeStart = '2020-10-08T06:00:00.000Z';
 const relativeEnd = '2020-10-08T07:00:00.000Z';
 
 function wrapper({ children }: { children: React.ReactElement }) {
-  return <HasDataContextProvider>{children}</HasDataContextProvider>;
+  const history = createMemoryHistory();
+  return (
+    <Router history={history}>
+      <HasDataContextProvider>{children}</HasDataContextProvider>
+    </Router>
+  );
 }
 
 function unregisterAll() {
diff --git a/x-pack/plugins/observability/public/context/has_data_context.tsx b/x-pack/plugins/observability/public/context/has_data_context.tsx
index 085b7fd7ba028..a2628d37828a4 100644
--- a/x-pack/plugins/observability/public/context/has_data_context.tsx
+++ b/x-pack/plugins/observability/public/context/has_data_context.tsx
@@ -7,6 +7,7 @@
 
 import { uniqueId } from 'lodash';
 import React, { createContext, useEffect, useState } from 'react';
+import { useRouteMatch } from 'react-router-dom';
 import { Alert } from '../../../alerting/common';
 import { getDataHandler } from '../data_handler';
 import { FETCH_STATUS } from '../hooks/use_fetcher';
@@ -41,35 +42,38 @@ export function HasDataContextProvider({ children }: { children: React.ReactNode
 
   const [hasData, setHasData] = useState<HasDataContextValue['hasData']>({});
 
+  const isExploratoryView = useRouteMatch('/exploratory-view');
+
   useEffect(
     () => {
-      apps.forEach(async (app) => {
-        try {
-          if (app !== 'alert') {
-            const params =
-              app === 'ux'
-                ? { absoluteTime: { start: absoluteStart, end: absoluteEnd } }
-                : undefined;
-
-            const result = await getDataHandler(app)?.hasData(params);
+      if (!isExploratoryView)
+        apps.forEach(async (app) => {
+          try {
+            if (app !== 'alert') {
+              const params =
+                app === 'ux'
+                  ? { absoluteTime: { start: absoluteStart, end: absoluteEnd } }
+                  : undefined;
+
+              const result = await getDataHandler(app)?.hasData(params);
+              setHasData((prevState) => ({
+                ...prevState,
+                [app]: {
+                  hasData: result,
+                  status: FETCH_STATUS.SUCCESS,
+                },
+              }));
+            }
+          } catch (e) {
             setHasData((prevState) => ({
               ...prevState,
               [app]: {
-                hasData: result,
-                status: FETCH_STATUS.SUCCESS,
+                hasData: undefined,
+                status: FETCH_STATUS.FAILURE,
               },
             }));
           }
-        } catch (e) {
-          setHasData((prevState) => ({
-            ...prevState,
-            [app]: {
-              hasData: undefined,
-              status: FETCH_STATUS.FAILURE,
-            },
-          }));
-        }
-      });
+        });
     },
     // eslint-disable-next-line react-hooks/exhaustive-deps
     []
diff --git a/x-pack/plugins/observability/public/hooks/use_breadcrumbs.ts b/x-pack/plugins/observability/public/hooks/use_breadcrumbs.ts
new file mode 100644
index 0000000000000..a354ac8a07f05
--- /dev/null
+++ b/x-pack/plugins/observability/public/hooks/use_breadcrumbs.ts
@@ -0,0 +1,71 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ChromeBreadcrumb } from 'kibana/public';
+import { i18n } from '@kbn/i18n';
+import { MouseEvent, useEffect } from 'react';
+import { EuiBreadcrumb } from '@elastic/eui';
+import { stringify } from 'query-string';
+import { useKibana } from '../../../../../src/plugins/kibana_react/public';
+import { useQueryParams } from './use_query_params';
+
+const EMPTY_QUERY = '?';
+
+function handleBreadcrumbClick(
+  breadcrumbs: ChromeBreadcrumb[],
+  navigateToHref?: (url: string) => Promise<void>
+) {
+  return breadcrumbs.map((bc) => ({
+    ...bc,
+    ...(bc.href
+      ? {
+          onClick: (event: MouseEvent) => {
+            if (navigateToHref && bc.href) {
+              event.preventDefault();
+              navigateToHref(bc.href);
+            }
+          },
+        }
+      : {}),
+  }));
+}
+
+export const makeBaseBreadcrumb = (href: string, params?: any): EuiBreadcrumb => {
+  if (params) {
+    const crumbParams = { ...params };
+
+    delete crumbParams.statusFilter;
+    const query = stringify(crumbParams, { skipEmptyString: true, skipNull: true });
+    href += query === EMPTY_QUERY ? '' : query;
+  }
+  return {
+    text: i18n.translate('xpack.observability.breadcrumbs.observability', {
+      defaultMessage: 'Observability',
+    }),
+    href,
+  };
+};
+
+export const useBreadcrumbs = (extraCrumbs: ChromeBreadcrumb[]) => {
+  const params = useQueryParams();
+
+  const {
+    services: { chrome, application },
+  } = useKibana();
+
+  const setBreadcrumbs = chrome?.setBreadcrumbs;
+  const appPath = application?.getUrlForApp('observability-overview') ?? '';
+  const navigate = application?.navigateToUrl;
+
+  useEffect(() => {
+    if (setBreadcrumbs) {
+      setBreadcrumbs(
+        handleBreadcrumbClick([makeBaseBreadcrumb(appPath, params)].concat(extraCrumbs), navigate)
+      );
+    }
+  }, [appPath, extraCrumbs, navigate, params, setBreadcrumbs]);
+};
diff --git a/x-pack/plugins/observability/public/hooks/use_quick_time_ranges.tsx b/x-pack/plugins/observability/public/hooks/use_quick_time_ranges.tsx
new file mode 100644
index 0000000000000..82a0fc39b8519
--- /dev/null
+++ b/x-pack/plugins/observability/public/hooks/use_quick_time_ranges.tsx
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useUiSetting } from '../../../../../src/plugins/kibana_react/public';
+import { UI_SETTINGS } from '../../../../../src/plugins/data/common';
+import { TimePickerQuickRange } from '../components/shared/exploratory_view/series_date_picker';
+
+export function useQuickTimeRanges() {
+  const timePickerQuickRanges = useUiSetting<TimePickerQuickRange[]>(
+    UI_SETTINGS.TIMEPICKER_QUICK_RANGES
+  );
+
+  return timePickerQuickRanges.map(({ from, to, display }) => ({
+    start: from,
+    end: to,
+    label: display,
+  }));
+}
diff --git a/x-pack/plugins/observability/public/hooks/use_values_list.ts b/x-pack/plugins/observability/public/hooks/use_values_list.ts
index 25a12ab4a9ebd..e17f515ed6cb9 100644
--- a/x-pack/plugins/observability/public/hooks/use_values_list.ts
+++ b/x-pack/plugins/observability/public/hooks/use_values_list.ts
@@ -5,32 +5,58 @@
  * 2.0.
  */
 
-import { IIndexPattern } from '../../../../../src/plugins/data/common';
+import { IndexPattern } from '../../../../../src/plugins/data/common';
 import { useKibana } from '../../../../../src/plugins/kibana_react/public';
+import { DataPublicPluginStart } from '../../../../../src/plugins/data/public';
 import { useFetcher } from './use_fetcher';
 import { ESFilter } from '../../../../../typings/elasticsearch';
-import { DataPublicPluginStart } from '../../../../../src/plugins/data/public';
 
-interface Props {
+export interface Props {
   sourceField: string;
   query?: string;
-  indexPattern: IIndexPattern;
+  indexPattern: IndexPattern;
   filters?: ESFilter[];
+  time?: { from: string; to: string };
 }
 
-export const useValuesList = ({ sourceField, indexPattern, query, filters }: Props) => {
+export const useValuesList = ({
+  sourceField,
+  indexPattern,
+  query = '',
+  filters,
+  time,
+}: Props): { values: string[]; loading?: boolean } => {
   const {
     services: { data },
   } = useKibana<{ data: DataPublicPluginStart }>();
 
-  const { data: values, status } = useFetcher(() => {
+  const { from, to } = time ?? {};
+
+  const { data: values, loading } = useFetcher(() => {
+    if (!sourceField || !indexPattern) {
+      return [];
+    }
     return data.autocomplete.getValueSuggestions({
       indexPattern,
       query: query || '',
-      field: indexPattern.fields.find(({ name }) => name === sourceField)!,
-      boolFilter: filters ?? [],
+      useTimeRange: !(from && to),
+      field: indexPattern.getFieldByName(sourceField)!,
+      boolFilter:
+        from && to
+          ? [
+              ...(filters || []),
+              {
+                range: {
+                  '@timestamp': {
+                    gte: from,
+                    lte: to,
+                  },
+                },
+              },
+            ]
+          : filters || [],
     });
-  }, [sourceField, query, data.autocomplete, indexPattern, filters]);
+  }, [query, sourceField, data.autocomplete, indexPattern, from, to, filters]);
 
-  return { values, loading: status === 'loading' || status === 'pending' };
+  return { values: values as string[], loading };
 };
diff --git a/x-pack/plugins/observability/public/index.ts b/x-pack/plugins/observability/public/index.ts
index 35443ca090077..837404d273ee4 100644
--- a/x-pack/plugins/observability/public/index.ts
+++ b/x-pack/plugins/observability/public/index.ts
@@ -55,3 +55,4 @@ export * from './typings';
 export { useChartTheme } from './hooks/use_chart_theme';
 export { useTheme } from './hooks/use_theme';
 export { getApmTraceUrl } from './utils/get_apm_trace_url';
+export { createExploratoryViewUrl } from './components/shared/exploratory_view/configurations/utils';
diff --git a/x-pack/plugins/observability/public/routes/index.tsx b/x-pack/plugins/observability/public/routes/index.tsx
index 20817901dab82..49cc55832dcf2 100644
--- a/x-pack/plugins/observability/public/routes/index.tsx
+++ b/x-pack/plugins/observability/public/routes/index.tsx
@@ -14,6 +14,7 @@ import { OverviewPage } from '../pages/overview';
 import { jsonRt } from './json_rt';
 import { AlertsPage } from '../pages/alerts';
 import { CasesPage } from '../pages/cases';
+import { ExploratoryViewPage } from '../components/shared/exploratory_view';
 
 export type RouteParams<T extends keyof typeof routes> = DecodeParams<typeof routes[T]['params']>;
 
@@ -115,4 +116,24 @@ export const routes = {
       },
     ],
   },
+  '/exploratory-view': {
+    handler: () => {
+      return <ExploratoryViewPage />;
+    },
+    params: {
+      query: t.partial({
+        rangeFrom: t.string,
+        rangeTo: t.string,
+        refreshPaused: jsonRt.pipe(t.boolean),
+        refreshInterval: jsonRt.pipe(t.number),
+      }),
+    },
+    breadcrumb: [
+      {
+        text: i18n.translate('xpack.observability.overview.exploratoryView', {
+          defaultMessage: 'Exploratory view',
+        }),
+      },
+    ],
+  },
 };
diff --git a/x-pack/plugins/observability/public/utils/observability_index_patterns.ts b/x-pack/plugins/observability/public/utils/observability_index_patterns.ts
new file mode 100644
index 0000000000000..b23a246105544
--- /dev/null
+++ b/x-pack/plugins/observability/public/utils/observability_index_patterns.ts
@@ -0,0 +1,64 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { DataPublicPluginStart, IndexPattern } from '../../../../../src/plugins/data/public';
+
+export type DataType = 'synthetics' | 'apm' | 'logs' | 'metrics' | 'rum';
+
+const indexPatternList: Record<DataType, string> = {
+  synthetics: 'synthetics_static_index_pattern_id',
+  apm: 'apm_static_index_pattern_id',
+  rum: 'apm_static_index_pattern_id',
+  logs: 'logs_static_index_pattern_id',
+  metrics: 'metrics_static_index_pattern_id',
+};
+
+const appToPatternMap: Record<DataType, string> = {
+  synthetics: 'heartbeat-*',
+  apm: 'apm-*',
+  rum: 'apm-*',
+  logs: 'logs-*,filebeat-*',
+  metrics: 'metrics-*,metricbeat-*',
+};
+
+export class ObservabilityIndexPatterns {
+  data?: DataPublicPluginStart;
+
+  constructor(data: DataPublicPluginStart) {
+    this.data = data;
+  }
+
+  async createIndexPattern(app: DataType) {
+    if (!this.data) {
+      throw new Error('data is not defined');
+    }
+
+    const pattern = appToPatternMap[app];
+
+    const fields = await this.data.indexPatterns.getFieldsForWildcard({
+      pattern,
+    });
+
+    return await this.data.indexPatterns.createAndSave({
+      fields,
+      title: pattern,
+      id: indexPatternList[app],
+      timeFieldName: '@timestamp',
+    });
+  }
+
+  async getIndexPattern(app: DataType): Promise<IndexPattern | undefined> {
+    if (!this.data) {
+      throw new Error('data is not defined');
+    }
+    try {
+      return await this.data?.indexPatterns.get(indexPatternList[app]);
+    } catch (e) {
+      return await this.createIndexPattern(app || 'apm');
+    }
+  }
+}
diff --git a/x-pack/plugins/observability/tsconfig.json b/x-pack/plugins/observability/tsconfig.json
index 083c35a26c20b..cc6e298795e4a 100644
--- a/x-pack/plugins/observability/tsconfig.json
+++ b/x-pack/plugins/observability/tsconfig.json
@@ -7,7 +7,14 @@
     "declaration": true,
     "declarationMap": true
   },
-  "include": ["common/**/*", "public/**/*", "server/**/*", "typings/**/*"],
+  "include": [
+    "common/**/*",
+    "public/**/*",
+    "public/**/*.json",
+    "server/**/*",
+    "typings/**/*",
+    "../../../typings/**/*"
+  ],
   "references": [
     { "path": "../../../src/core/tsconfig.json" },
     { "path": "../../../src/plugins/data/tsconfig.json" },
diff --git a/x-pack/plugins/uptime/public/apps/plugin.ts b/x-pack/plugins/uptime/public/apps/plugin.ts
index e3457884594a9..7ea6b72547386 100644
--- a/x-pack/plugins/uptime/public/apps/plugin.ts
+++ b/x-pack/plugins/uptime/public/apps/plugin.ts
@@ -68,18 +68,21 @@ export class UptimePlugin
 
       return UptimeDataHelper(coreStart);
     };
-    plugins.observability.dashboard.register({
-      appName: 'uptime',
-      hasData: async () => {
-        const dataHelper = await getUptimeDataHelper();
-        const status = await dataHelper.indexStatus();
-        return status.docCount > 0;
-      },
-      fetchData: async (params: FetchDataParams) => {
-        const dataHelper = await getUptimeDataHelper();
-        return await dataHelper.overviewData(params);
-      },
-    });
+
+    if (plugins.observability) {
+      plugins.observability.dashboard.register({
+        appName: 'uptime',
+        hasData: async () => {
+          const dataHelper = await getUptimeDataHelper();
+          const status = await dataHelper.indexStatus();
+          return status.docCount > 0;
+        },
+        fetchData: async (params: FetchDataParams) => {
+          const dataHelper = await getUptimeDataHelper();
+          return await dataHelper.overviewData(params);
+        },
+      });
+    }
 
     core.application.register({
       id: PLUGIN.ID,

From 9cebff12980d7afe2e4b13fcb15c26c627f38498 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cau=C3=AA=20Marcondes?=
 <55978943+cauemarcondes@users.noreply.github.com>
Date: Mon, 5 Apr 2021 10:51:56 -0400
Subject: [PATCH 10/17] [OBS]home page is showing incorrect value of APM
 throughput (tpm) (#95991)

* fixing obs transaction per minute value

* addressing PR comments

* fixing unit test

* addressing PR comments

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 ...pm_observability_overview_fetchers.test.ts | 20 ++--
 .../apm_observability_overview_fetchers.ts    | 12 +--
 .../get_transaction_coordinates.ts            | 64 -------------
 .../get_transactions_per_minute.ts            | 95 +++++++++++++++++++
 .../server/routes/observability_overview.ts   |  8 +-
 .../components/app/section/apm/index.test.tsx | 26 +++++
 .../components/app/section/apm/index.tsx      | 15 ++-
 .../typings/fetch_overview_data/index.ts      |  2 +-
 .../observability_overview.ts                 | 19 ++--
 9 files changed, 166 insertions(+), 95 deletions(-)
 delete mode 100644 x-pack/plugins/apm/server/lib/observability_overview/get_transaction_coordinates.ts
 create mode 100644 x-pack/plugins/apm/server/lib/observability_overview/get_transactions_per_minute.ts

diff --git a/x-pack/plugins/apm/public/services/rest/apm_observability_overview_fetchers.test.ts b/x-pack/plugins/apm/public/services/rest/apm_observability_overview_fetchers.test.ts
index 1821e92ee5a78..29fabc51fd582 100644
--- a/x-pack/plugins/apm/public/services/rest/apm_observability_overview_fetchers.test.ts
+++ b/x-pack/plugins/apm/public/services/rest/apm_observability_overview_fetchers.test.ts
@@ -46,11 +46,14 @@ describe('Observability dashboard data', () => {
       callApmApiMock.mockImplementation(() =>
         Promise.resolve({
           serviceCount: 10,
-          transactionCoordinates: [
-            { x: 1, y: 1 },
-            { x: 2, y: 2 },
-            { x: 3, y: 3 },
-          ],
+          transactionPerMinute: {
+            value: 2,
+            timeseries: [
+              { x: 1, y: 1 },
+              { x: 2, y: 2 },
+              { x: 3, y: 3 },
+            ],
+          },
         })
       );
       const response = await fetchObservabilityOverviewPageData(params);
@@ -81,7 +84,7 @@ describe('Observability dashboard data', () => {
       callApmApiMock.mockImplementation(() =>
         Promise.resolve({
           serviceCount: 0,
-          transactionCoordinates: [],
+          transactionPerMinute: { value: null, timeseries: [] },
         })
       );
       const response = await fetchObservabilityOverviewPageData(params);
@@ -108,7 +111,10 @@ describe('Observability dashboard data', () => {
       callApmApiMock.mockImplementation(() =>
         Promise.resolve({
           serviceCount: 0,
-          transactionCoordinates: [{ x: 1 }, { x: 2 }, { x: 3 }],
+          transactionPerMinute: {
+            value: 0,
+            timeseries: [{ x: 1 }, { x: 2 }, { x: 3 }],
+          },
         })
       );
       const response = await fetchObservabilityOverviewPageData(params);
diff --git a/x-pack/plugins/apm/public/services/rest/apm_observability_overview_fetchers.ts b/x-pack/plugins/apm/public/services/rest/apm_observability_overview_fetchers.ts
index 55ead8d942aca..3a02efd05e5a5 100644
--- a/x-pack/plugins/apm/public/services/rest/apm_observability_overview_fetchers.ts
+++ b/x-pack/plugins/apm/public/services/rest/apm_observability_overview_fetchers.ts
@@ -5,7 +5,6 @@
  * 2.0.
  */
 
-import { mean } from 'lodash';
 import {
   ApmFetchDataResponse,
   FetchDataParams,
@@ -31,7 +30,7 @@ export const fetchObservabilityOverviewPageData = async ({
     },
   });
 
-  const { serviceCount, transactionCoordinates } = data;
+  const { serviceCount, transactionPerMinute } = data;
 
   return {
     appLink: `/app/apm/services?rangeFrom=${relativeTime.start}&rangeTo=${relativeTime.end}`,
@@ -42,17 +41,12 @@ export const fetchObservabilityOverviewPageData = async ({
       },
       transactions: {
         type: 'number',
-        value:
-          mean(
-            transactionCoordinates
-              .map(({ y }) => y)
-              .filter((y) => y && isFinite(y))
-          ) || 0,
+        value: transactionPerMinute.value || 0,
       },
     },
     series: {
       transactions: {
-        coordinates: transactionCoordinates,
+        coordinates: transactionPerMinute.timeseries,
       },
     },
   };
diff --git a/x-pack/plugins/apm/server/lib/observability_overview/get_transaction_coordinates.ts b/x-pack/plugins/apm/server/lib/observability_overview/get_transaction_coordinates.ts
deleted file mode 100644
index aac18e2bdfe4c..0000000000000
--- a/x-pack/plugins/apm/server/lib/observability_overview/get_transaction_coordinates.ts
+++ /dev/null
@@ -1,64 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { rangeQuery } from '../../../server/utils/queries';
-import { Coordinates } from '../../../../observability/typings/common';
-import { Setup, SetupTimeRange } from '../helpers/setup_request';
-import { getProcessorEventForAggregatedTransactions } from '../helpers/aggregated_transactions';
-import { calculateThroughput } from '../helpers/calculate_throughput';
-import { withApmSpan } from '../../utils/with_apm_span';
-
-export function getTransactionCoordinates({
-  setup,
-  bucketSize,
-  searchAggregatedTransactions,
-}: {
-  setup: Setup & SetupTimeRange;
-  bucketSize: string;
-  searchAggregatedTransactions: boolean;
-}): Promise<Coordinates[]> {
-  return withApmSpan(
-    'observability_overview_get_transaction_distribution',
-    async () => {
-      const { apmEventClient, start, end } = setup;
-
-      const { aggregations } = await apmEventClient.search({
-        apm: {
-          events: [
-            getProcessorEventForAggregatedTransactions(
-              searchAggregatedTransactions
-            ),
-          ],
-        },
-        body: {
-          size: 0,
-          query: {
-            bool: {
-              filter: rangeQuery(start, end),
-            },
-          },
-          aggs: {
-            distribution: {
-              date_histogram: {
-                field: '@timestamp',
-                fixed_interval: bucketSize,
-                min_doc_count: 0,
-              },
-            },
-          },
-        },
-      });
-
-      return (
-        aggregations?.distribution.buckets.map((bucket) => ({
-          x: bucket.key,
-          y: calculateThroughput({ start, end, value: bucket.doc_count }),
-        })) || []
-      );
-    }
-  );
-}
diff --git a/x-pack/plugins/apm/server/lib/observability_overview/get_transactions_per_minute.ts b/x-pack/plugins/apm/server/lib/observability_overview/get_transactions_per_minute.ts
new file mode 100644
index 0000000000000..da8ac7c50b594
--- /dev/null
+++ b/x-pack/plugins/apm/server/lib/observability_overview/get_transactions_per_minute.ts
@@ -0,0 +1,95 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  TRANSACTION_PAGE_LOAD,
+  TRANSACTION_REQUEST,
+} from '../../../common/transaction_types';
+import { TRANSACTION_TYPE } from '../../../common/elasticsearch_fieldnames';
+import { rangeQuery } from '../../../server/utils/queries';
+import { Setup, SetupTimeRange } from '../helpers/setup_request';
+import { getProcessorEventForAggregatedTransactions } from '../helpers/aggregated_transactions';
+import { calculateThroughput } from '../helpers/calculate_throughput';
+import { withApmSpan } from '../../utils/with_apm_span';
+
+export function getTransactionsPerMinute({
+  setup,
+  bucketSize,
+  searchAggregatedTransactions,
+}: {
+  setup: Setup & SetupTimeRange;
+  bucketSize: string;
+  searchAggregatedTransactions: boolean;
+}) {
+  return withApmSpan(
+    'observability_overview_get_transactions_per_minute',
+    async () => {
+      const { apmEventClient, start, end } = setup;
+
+      const { aggregations } = await apmEventClient.search({
+        apm: {
+          events: [
+            getProcessorEventForAggregatedTransactions(
+              searchAggregatedTransactions
+            ),
+          ],
+        },
+        body: {
+          size: 0,
+          query: {
+            bool: {
+              filter: rangeQuery(start, end),
+            },
+          },
+          aggs: {
+            transactionType: {
+              terms: {
+                field: TRANSACTION_TYPE,
+              },
+              aggs: {
+                timeseries: {
+                  date_histogram: {
+                    field: '@timestamp',
+                    fixed_interval: bucketSize,
+                    min_doc_count: 0,
+                  },
+                  aggs: {
+                    throughput: { rate: { unit: 'minute' as const } },
+                  },
+                },
+              },
+            },
+          },
+        },
+      });
+
+      if (!aggregations || !aggregations.transactionType.buckets) {
+        return { value: undefined, timeseries: [] };
+      }
+
+      const topTransactionTypeBucket =
+        aggregations.transactionType.buckets.find(
+          ({ key: transactionType }) =>
+            transactionType === TRANSACTION_REQUEST ||
+            transactionType === TRANSACTION_PAGE_LOAD
+        ) || aggregations.transactionType.buckets[0];
+
+      return {
+        value: calculateThroughput({
+          start,
+          end,
+          value: topTransactionTypeBucket?.doc_count || 0,
+        }),
+        timeseries:
+          topTransactionTypeBucket?.timeseries.buckets.map((bucket) => ({
+            x: bucket.key,
+            y: bucket.throughput.value,
+          })) || [],
+      };
+    }
+  );
+}
diff --git a/x-pack/plugins/apm/server/routes/observability_overview.ts b/x-pack/plugins/apm/server/routes/observability_overview.ts
index b9c0a76b6fb90..1aac2c09d01c5 100644
--- a/x-pack/plugins/apm/server/routes/observability_overview.ts
+++ b/x-pack/plugins/apm/server/routes/observability_overview.ts
@@ -8,7 +8,7 @@
 import * as t from 'io-ts';
 import { setupRequest } from '../lib/helpers/setup_request';
 import { getServiceCount } from '../lib/observability_overview/get_service_count';
-import { getTransactionCoordinates } from '../lib/observability_overview/get_transaction_coordinates';
+import { getTransactionsPerMinute } from '../lib/observability_overview/get_transactions_per_minute';
 import { getHasData } from '../lib/observability_overview/has_data';
 import { createRoute } from './create_route';
 import { rangeRt } from './default_api_types';
@@ -39,18 +39,18 @@ export const observabilityOverviewRoute = createRoute({
     );
 
     return withApmSpan('observability_overview', async () => {
-      const [serviceCount, transactionCoordinates] = await Promise.all([
+      const [serviceCount, transactionPerMinute] = await Promise.all([
         getServiceCount({
           setup,
           searchAggregatedTransactions,
         }),
-        getTransactionCoordinates({
+        getTransactionsPerMinute({
           setup,
           bucketSize,
           searchAggregatedTransactions,
         }),
       ]);
-      return { serviceCount, transactionCoordinates };
+      return { serviceCount, transactionPerMinute };
     });
   },
 });
diff --git a/x-pack/plugins/observability/public/components/app/section/apm/index.test.tsx b/x-pack/plugins/observability/public/components/app/section/apm/index.test.tsx
index e5f100be285e1..d29481a39eb72 100644
--- a/x-pack/plugins/observability/public/components/app/section/apm/index.test.tsx
+++ b/x-pack/plugins/observability/public/components/app/section/apm/index.test.tsx
@@ -56,6 +56,32 @@ describe('APMSection', () => {
       } as unknown) as ObservabilityPublicPluginsStart,
     }));
   });
+
+  it('renders transaction stat less then 1k', () => {
+    const resp = {
+      appLink: '/app/apm',
+      stats: {
+        services: { value: 11, type: 'number' },
+        transactions: { value: 900, type: 'number' },
+      },
+      series: {
+        transactions: { coordinates: [] },
+      },
+    };
+    jest.spyOn(fetcherHook, 'useFetcher').mockReturnValue({
+      data: resp,
+      status: fetcherHook.FETCH_STATUS.SUCCESS,
+      refetch: jest.fn(),
+    });
+    const { getByText, queryAllByTestId } = render(<APMSection bucketSize="60s" />);
+
+    expect(getByText('APM')).toBeInTheDocument();
+    expect(getByText('View in app')).toBeInTheDocument();
+    expect(getByText('Services 11')).toBeInTheDocument();
+    expect(getByText('Throughput 900.0 tpm')).toBeInTheDocument();
+    expect(queryAllByTestId('loading')).toEqual([]);
+  });
+
   it('renders with transaction series and stats', () => {
     jest.spyOn(fetcherHook, 'useFetcher').mockReturnValue({
       data: response,
diff --git a/x-pack/plugins/observability/public/components/app/section/apm/index.tsx b/x-pack/plugins/observability/public/components/app/section/apm/index.tsx
index 91a536840ecbd..e71468d3b028c 100644
--- a/x-pack/plugins/observability/public/components/app/section/apm/index.tsx
+++ b/x-pack/plugins/observability/public/components/app/section/apm/index.tsx
@@ -31,6 +31,19 @@ function formatTpm(value?: number) {
   return numeral(value).format('0.00a');
 }
 
+function formatTpmStat(value?: number) {
+  if (!value || value === 0) {
+    return '0';
+  }
+  if (value <= 0.1) {
+    return '< 0.1';
+  }
+  if (value > 1000) {
+    return numeral(value).format('0.00a');
+  }
+  return numeral(value).format('0,0.0');
+}
+
 export function APMSection({ bucketSize }: Props) {
   const theme = useContext(ThemeContext);
   const chartTheme = useChartTheme();
@@ -93,7 +106,7 @@ export function APMSection({ bucketSize }: Props) {
         </EuiFlexItem>
         <EuiFlexItem grow={false}>
           <StyledStat
-            title={`${formatTpm(stats?.transactions.value)} tpm`}
+            title={`${formatTpmStat(stats?.transactions.value)} tpm`}
             description={i18n.translate('xpack.observability.overview.apm.throughput', {
               defaultMessage: 'Throughput',
             })}
diff --git a/x-pack/plugins/observability/public/typings/fetch_overview_data/index.ts b/x-pack/plugins/observability/public/typings/fetch_overview_data/index.ts
index f4e824784fe09..e9960833a1c4f 100644
--- a/x-pack/plugins/observability/public/typings/fetch_overview_data/index.ts
+++ b/x-pack/plugins/observability/public/typings/fetch_overview_data/index.ts
@@ -15,7 +15,7 @@ export interface Stat {
 
 export interface Coordinates {
   x: number;
-  y?: number;
+  y?: number | null;
 }
 
 export interface Series {
diff --git a/x-pack/test/apm_api_integration/tests/observability_overview/observability_overview.ts b/x-pack/test/apm_api_integration/tests/observability_overview/observability_overview.ts
index 2af5f51953b23..746e746ccd827 100644
--- a/x-pack/test/apm_api_integration/tests/observability_overview/observability_overview.ts
+++ b/x-pack/test/apm_api_integration/tests/observability_overview/observability_overview.ts
@@ -33,7 +33,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
           expect(response.status).to.be(200);
 
           expect(response.body.serviceCount).to.be(0);
-          expect(response.body.transactionCoordinates.length).to.be(0);
+          expect(response.body.transactionPerMinute.timeseries.length).to.be(0);
         });
       });
     }
@@ -50,14 +50,15 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         expect(response.status).to.be(200);
 
         expect(response.body.serviceCount).to.be.greaterThan(0);
-        expect(response.body.transactionCoordinates.length).to.be.greaterThan(0);
+        expect(response.body.transactionPerMinute.timeseries.length).to.be.greaterThan(0);
 
         expectSnapshot(response.body.serviceCount).toMatchInline(`9`);
 
-        expectSnapshot(response.body.transactionCoordinates.length).toMatchInline(`31`);
+        expectSnapshot(response.body.transactionPerMinute.value).toMatchInline(`64.8`);
+        expectSnapshot(response.body.transactionPerMinute.timeseries.length).toMatchInline(`31`);
 
         expectSnapshot(
-          response.body.transactionCoordinates
+          response.body.transactionPerMinute.timeseries
             .slice(0, 5)
             .map(({ x, y }: { x: number; y: number }) => ({
               x: new Date(x).toISOString(),
@@ -67,23 +68,23 @@ export default function ApiTest({ getService }: FtrProviderContext) {
           Array [
             Object {
               "x": "2020-12-08T13:57:00.000Z",
-              "y": 0.166666666666667,
+              "y": 2,
             },
             Object {
               "x": "2020-12-08T13:58:00.000Z",
-              "y": 5.23333333333333,
+              "y": 61,
             },
             Object {
               "x": "2020-12-08T13:59:00.000Z",
-              "y": 4.4,
+              "y": 36,
             },
             Object {
               "x": "2020-12-08T14:00:00.000Z",
-              "y": 5.73333333333333,
+              "y": 75,
             },
             Object {
               "x": "2020-12-08T14:01:00.000Z",
-              "y": 4.33333333333333,
+              "y": 36,
             },
           ]
         `);

From 123f3400a82f89a7be5a6c2d9526e62102530c47 Mon Sep 17 00:00:00 2001
From: Scotty Bollinger <scotty.bollinger@elastic.co>
Date: Mon, 5 Apr 2021 10:19:32 -0500
Subject: [PATCH 11/17] [Workplace Search] Add sub nav and fix rendering bugs
 in Personal dashboard (#96100)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Fix route for private deferated source summary

* Make schema types nullable

Federated sources don’t have counts and the server returns null so our routes have to expect that sometimes these values will be null

* Add SourceSubNav to Personal dashboard

We are able to leverage the existing component with a couple a small change; the existing componet is a subnav in the larger Enterprise Search shared navigation component and does not include its styles. This caused the list items to render with bullet points next to them. Adding this class and displaying the nav items as block elements fixes this issue.

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../views/content_sources/components/source_sub_nav.tsx     | 4 ++--
 .../views/content_sources/private_sources_layout.test.tsx   | 3 +++
 .../views/content_sources/private_sources_layout.tsx        | 3 +++
 .../views/content_sources/source_logic.test.ts              | 2 +-
 .../workplace_search/views/content_sources/source_logic.ts  | 2 +-
 .../workplace_search/views/content_sources/sources.scss     | 6 ++++++
 .../server/routes/workplace_search/sources.ts               | 6 +++---
 7 files changed, 19 insertions(+), 7 deletions(-)

diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/source_sub_nav.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/source_sub_nav.tsx
index 99cebd5ded585..bf0c5471f7b57 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/source_sub_nav.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/source_sub_nav.tsx
@@ -33,7 +33,7 @@ export const SourceSubNav: React.FC = () => {
   const isCustom = serviceType === CUSTOM_SERVICE_TYPE;
 
   return (
-    <>
+    <div className="sourcesSubNav">
       <SideNavLink to={getContentSourcePath(SOURCE_DETAILS_PATH, id, isOrganization)}>
         {NAV.OVERVIEW}
       </SideNavLink>
@@ -53,6 +53,6 @@ export const SourceSubNav: React.FC = () => {
       <SideNavLink to={getContentSourcePath(SOURCE_SETTINGS_PATH, id, isOrganization)}>
         {NAV.SETTINGS}
       </SideNavLink>
-    </>
+    </div>
   );
 };
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/private_sources_layout.test.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/private_sources_layout.test.tsx
index 488eb4b49853b..9e3b50ea083eb 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/private_sources_layout.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/private_sources_layout.test.tsx
@@ -17,6 +17,8 @@ import { EuiCallOut } from '@elastic/eui';
 
 import { ViewContentHeader } from '../../components/shared/view_content_header';
 
+import { SourceSubNav } from './components/source_sub_nav';
+
 import {
   PRIVATE_CAN_CREATE_PAGE_TITLE,
   PRIVATE_VIEW_ONLY_PAGE_TITLE,
@@ -40,6 +42,7 @@ describe('PrivateSourcesLayout', () => {
     const wrapper = shallow(<PrivateSourcesLayout>{children}</PrivateSourcesLayout>);
 
     expect(wrapper.find('[data-test-subj="TestChildren"]')).toHaveLength(1);
+    expect(wrapper.find(SourceSubNav)).toHaveLength(1);
   });
 
   it('uses correct title and description when private sources are enabled', () => {
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/private_sources_layout.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/private_sources_layout.tsx
index bdc2421432c8a..2a6281075dc40 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/private_sources_layout.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/private_sources_layout.tsx
@@ -14,6 +14,8 @@ import { EuiPage, EuiPageSideBar, EuiPageBody, EuiCallOut } from '@elastic/eui';
 import { AppLogic } from '../../app_logic';
 import { ViewContentHeader } from '../../components/shared/view_content_header';
 
+import { SourceSubNav } from './components/source_sub_nav';
+
 import {
   PRIVATE_DASHBOARD_READ_ONLY_MODE_WARNING,
   PRIVATE_CAN_CREATE_PAGE_TITLE,
@@ -49,6 +51,7 @@ export const PrivateSourcesLayout: React.FC<LayoutProps> = ({
     <EuiPage className="enterpriseSearchLayout privateSourcesLayout">
       <EuiPageSideBar className="enterpriseSearchLayout__sideBar privateSourcesLayout__sideBar">
         <ViewContentHeader title={PAGE_TITLE} description={PAGE_DESCRIPTION} />
+        <SourceSubNav />
       </EuiPageSideBar>
       <EuiPageBody className="enterpriseSearchLayout__body" restrictWidth={restrictWidth}>
         {readOnlyMode && (
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/source_logic.test.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/source_logic.test.ts
index d20d0576d11ce..a9712cc4e1dc0 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/source_logic.test.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/source_logic.test.ts
@@ -214,7 +214,7 @@ describe('SourceLogic', () => {
         SourceLogic.actions.initializeFederatedSummary(contentSource.id);
 
         expect(http.get).toHaveBeenCalledWith(
-          '/api/workplace_search/org/sources/123/federated_summary'
+          '/api/workplace_search/account/sources/123/federated_summary'
         );
         await promise;
         expect(onUpdateSummarySpy).toHaveBeenCalledWith(contentSource.summary);
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/source_logic.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/source_logic.ts
index 72700ce42c75d..3da90c4fc7739 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/source_logic.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/source_logic.ts
@@ -156,7 +156,7 @@ export const SourceLogic = kea<MakeLogicType<SourceValues, SourceActions>>({
       }
     },
     initializeFederatedSummary: async ({ sourceId }) => {
-      const route = `/api/workplace_search/org/sources/${sourceId}/federated_summary`;
+      const route = `/api/workplace_search/account/sources/${sourceId}/federated_summary`;
       try {
         const response = await HttpLogic.values.http.get(route);
         actions.onUpdateSummary(response.summary);
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/sources.scss b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/sources.scss
index f142567fb621f..abab139e32369 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/sources.scss
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/sources.scss
@@ -30,3 +30,9 @@
     margin-left: -$sideBarWidth;
   }
 }
+
+.sourcesSubNav {
+  li {
+    display: block;
+  }
+}
diff --git a/x-pack/plugins/enterprise_search/server/routes/workplace_search/sources.ts b/x-pack/plugins/enterprise_search/server/routes/workplace_search/sources.ts
index 8257dd0dc52b0..1dd6d859d88ad 100644
--- a/x-pack/plugins/enterprise_search/server/routes/workplace_search/sources.ts
+++ b/x-pack/plugins/enterprise_search/server/routes/workplace_search/sources.ts
@@ -22,9 +22,9 @@ const schemaValuesSchema = schema.recordOf(
 );
 
 const pageSchema = schema.object({
-  current: schema.number(),
-  size: schema.number(),
-  total_pages: schema.number(),
+  current: schema.nullable(schema.number()),
+  size: schema.nullable(schema.number()),
+  total_pages: schema.nullable(schema.number()),
   total_results: schema.number(),
 });
 

From ea03eb1bab086b6e6e526d8c1eb11ffa877d7d52 Mon Sep 17 00:00:00 2001
From: Scotty Bollinger <scotty.bollinger@elastic.co>
Date: Mon, 5 Apr 2021 10:27:05 -0500
Subject: [PATCH 12/17] [Enterprise Search] Expose core.chrome.setIsVisible for
 use in Workplace Search (#95984)

* Hide chrome for Workplace Search by default

The Workplace Search Personal dashboard needs the chrome hidden. We hide it globally here first to prevent a flash of chrome on the Personal dashboard and unhide it for admin routes, which will be in a future commit

* Add core.chrome.setIsVisible to KibanaLogic

* Toggle chrome visibility for Workplace Search

* Add test

* Refactor to set context and chrome when pathname changes

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../applications/__mocks__/kibana_logic.mock.ts      |  1 +
 .../enterprise_search/public/applications/index.tsx  |  1 +
 .../applications/shared/kibana/kibana_logic.ts       |  2 ++
 .../applications/workplace_search/index.test.tsx     |  4 +++-
 .../public/applications/workplace_search/index.tsx   | 12 +++++++-----
 x-pack/plugins/enterprise_search/public/plugin.ts    |  3 +++
 6 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/x-pack/plugins/enterprise_search/public/applications/__mocks__/kibana_logic.mock.ts b/x-pack/plugins/enterprise_search/public/applications/__mocks__/kibana_logic.mock.ts
index 133f704fd59a9..2325ddcf2b270 100644
--- a/x-pack/plugins/enterprise_search/public/applications/__mocks__/kibana_logic.mock.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/__mocks__/kibana_logic.mock.ts
@@ -19,6 +19,7 @@ export const mockKibanaValues = {
   history: mockHistory,
   navigateToUrl: jest.fn(),
   setBreadcrumbs: jest.fn(),
+  setChromeIsVisible: jest.fn(),
   setDocTitle: jest.fn(),
   renderHeaderActions: jest.fn(),
 };
diff --git a/x-pack/plugins/enterprise_search/public/applications/index.tsx b/x-pack/plugins/enterprise_search/public/applications/index.tsx
index 155ff5b92ba27..c2bf77751528a 100644
--- a/x-pack/plugins/enterprise_search/public/applications/index.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/index.tsx
@@ -49,6 +49,7 @@ export const renderApp = (
     history: params.history,
     navigateToUrl: core.application.navigateToUrl,
     setBreadcrumbs: core.chrome.setBreadcrumbs,
+    setChromeIsVisible: core.chrome.setIsVisible,
     setDocTitle: core.chrome.docTitle.change,
     renderHeaderActions: (HeaderActions) =>
       params.setHeaderActionMenu((el) => renderHeaderActions(HeaderActions, store, el)),
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/kibana/kibana_logic.ts b/x-pack/plugins/enterprise_search/public/applications/shared/kibana/kibana_logic.ts
index 8015d22f7c44a..2bef7d373f160 100644
--- a/x-pack/plugins/enterprise_search/public/applications/shared/kibana/kibana_logic.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/kibana/kibana_logic.ts
@@ -24,6 +24,7 @@ interface KibanaLogicProps {
   charts: ChartsPluginStart;
   navigateToUrl: ApplicationStart['navigateToUrl'];
   setBreadcrumbs(crumbs: ChromeBreadcrumb[]): void;
+  setChromeIsVisible(isVisible: boolean): void;
   setDocTitle(title: string): void;
   renderHeaderActions(HeaderActions: FC): void;
 }
@@ -47,6 +48,7 @@ export const KibanaLogic = kea<MakeLogicType<KibanaValues>>({
       {},
     ],
     setBreadcrumbs: [props.setBreadcrumbs, {}],
+    setChromeIsVisible: [props.setChromeIsVisible, {}],
     setDocTitle: [props.setDocTitle, {}],
     renderHeaderActions: [props.renderHeaderActions, {}],
   }),
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/index.test.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/index.test.tsx
index 48bdcd6551b65..a2c0ec18def4b 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/index.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/index.test.tsx
@@ -57,11 +57,13 @@ describe('WorkplaceSearchConfigured', () => {
     setMockActions({ initializeAppData, setContext });
   });
 
-  it('renders layout and header actions', () => {
+  it('renders layout, chrome, and header actions', () => {
     const wrapper = shallow(<WorkplaceSearchConfigured />);
 
     expect(wrapper.find(Layout).first().prop('readOnlyMode')).toBeFalsy();
     expect(wrapper.find(OverviewMVP)).toHaveLength(1);
+
+    expect(mockKibanaValues.setChromeIsVisible).toHaveBeenCalledWith(true);
     expect(mockKibanaValues.renderHeaderActions).toHaveBeenCalledWith(WorkplaceSearchHeaderActions);
   });
 
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/index.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/index.tsx
index c269a987dc092..7a76de43be41b 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/index.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/index.tsx
@@ -53,7 +53,7 @@ export const WorkplaceSearch: React.FC<InitialAppData> = (props) => {
 export const WorkplaceSearchConfigured: React.FC<InitialAppData> = (props) => {
   const { hasInitialized } = useValues(AppLogic);
   const { initializeAppData, setContext } = useActions(AppLogic);
-  const { renderHeaderActions } = useValues(KibanaLogic);
+  const { renderHeaderActions, setChromeIsVisible } = useValues(KibanaLogic);
   const { errorConnecting, readOnlyMode } = useValues(HttpLogic);
 
   const { pathname } = useLocation();
@@ -66,11 +66,13 @@ export const WorkplaceSearchConfigured: React.FC<InitialAppData> = (props) => {
    * Personal dashboard urls begin with /p/
    * EX: http://localhost:5601/app/enterprise_search/workplace_search/p/sources
    */
-  const personalSourceUrlRegex = /^\/p\//g; // matches '/p/*'
+  useEffect(() => {
+    const personalSourceUrlRegex = /^\/p\//g; // matches '/p/*'
+    const isOrganization = !pathname.match(personalSourceUrlRegex); // TODO: Once auth is figured out, we need to have a check for the equivilent of `isAdmin`.
 
-  // TODO: Once auth is figured out, we need to have a check for the equivilent of `isAdmin`.
-  const isOrganization = !pathname.match(personalSourceUrlRegex);
-  setContext(isOrganization);
+    setContext(isOrganization);
+    setChromeIsVisible(isOrganization);
+  }, [pathname]);
 
   useEffect(() => {
     if (!hasInitialized) {
diff --git a/x-pack/plugins/enterprise_search/public/plugin.ts b/x-pack/plugins/enterprise_search/public/plugin.ts
index f00e81a5accf7..dd1a62d243d03 100644
--- a/x-pack/plugins/enterprise_search/public/plugin.ts
+++ b/x-pack/plugins/enterprise_search/public/plugin.ts
@@ -114,6 +114,9 @@ export class EnterpriseSearchPlugin implements Plugin {
         const { chrome, http } = kibanaDeps.core;
         chrome.docTitle.change(WORKPLACE_SEARCH_PLUGIN.NAME);
 
+        // The Workplace Search Personal dashboard needs the chrome hidden. We hide it globally
+        // here first to prevent a flash of chrome on the Personal dashboard and unhide it for admin routes.
+        chrome.setIsVisible(false);
         await this.getInitialData(http);
         const pluginData = this.getPluginData();
 

From 95e45ddebc6e86bb3d63f04bd7c4e56ad8ef55bb Mon Sep 17 00:00:00 2001
From: Pierre Gayvallet <pierre.gayvallet@gmail.com>
Date: Mon, 5 Apr 2021 18:00:13 +0200
Subject: [PATCH 13/17] Use plugin version in its publicPath (#95945)

* Use plugin version in its publicPath

* remove useless comment

* fix types

* update generated doc
---
 .../register_bundle_routes.test.ts            | 15 +++++++------
 .../bundle_routes/register_bundle_routes.ts   |  8 +++----
 src/core/server/legacy/legacy_service.test.ts |  1 +
 .../server/plugins/plugins_service.test.ts    | 14 ++++++++++---
 src/core/server/plugins/plugins_service.ts    |  1 +
 src/core/server/plugins/plugins_system.ts     |  1 +
 src/core/server/plugins/types.ts              | 13 +++++++++---
 .../bootstrap/get_plugin_bundle_paths.test.ts | 21 ++++++++++++-------
 .../bootstrap/get_plugin_bundle_paths.ts      | 10 +++++++--
 src/core/server/server.api.md                 |  8 +++----
 10 files changed, 63 insertions(+), 29 deletions(-)

diff --git a/src/core/server/core_app/bundle_routes/register_bundle_routes.test.ts b/src/core/server/core_app/bundle_routes/register_bundle_routes.test.ts
index d51c369146957..830f4a9a94364 100644
--- a/src/core/server/core_app/bundle_routes/register_bundle_routes.test.ts
+++ b/src/core/server/core_app/bundle_routes/register_bundle_routes.test.ts
@@ -10,7 +10,7 @@ import { registerRouteForBundleMock } from './register_bundle_routes.test.mocks'
 
 import { PackageInfo } from '@kbn/config';
 import { httpServiceMock } from '../../http/http_service.mock';
-import { UiPlugins } from '../../plugins';
+import { InternalPluginInfo, UiPlugins } from '../../plugins';
 import { registerBundleRoutes } from './register_bundle_routes';
 import { FileHashCache } from './file_hash_cache';
 
@@ -29,9 +29,12 @@ const createUiPlugins = (...ids: string[]): UiPlugins => ({
   internal: ids.reduce((map, id) => {
     map.set(id, {
       publicTargetDir: `/plugins/${id}/public-target-dir`,
+      publicAssetsDir: `/plugins/${id}/public-assets-dir`,
+      version: '8.0.0',
+      requiredBundles: [],
     });
     return map;
-  }, new Map()),
+  }, new Map<string, InternalPluginInfo>()),
 });
 
 describe('registerBundleRoutes', () => {
@@ -86,16 +89,16 @@ describe('registerBundleRoutes', () => {
       fileHashCache: expect.any(FileHashCache),
       isDist: true,
       bundlesPath: '/plugins/plugin-a/public-target-dir',
-      publicPath: '/server-base-path/42/bundles/plugin/plugin-a/',
-      routePath: '/42/bundles/plugin/plugin-a/',
+      publicPath: '/server-base-path/42/bundles/plugin/plugin-a/8.0.0/',
+      routePath: '/42/bundles/plugin/plugin-a/8.0.0/',
     });
 
     expect(registerRouteForBundleMock).toHaveBeenCalledWith(router, {
       fileHashCache: expect.any(FileHashCache),
       isDist: true,
       bundlesPath: '/plugins/plugin-b/public-target-dir',
-      publicPath: '/server-base-path/42/bundles/plugin/plugin-b/',
-      routePath: '/42/bundles/plugin/plugin-b/',
+      publicPath: '/server-base-path/42/bundles/plugin/plugin-b/8.0.0/',
+      routePath: '/42/bundles/plugin/plugin-b/8.0.0/',
     });
   });
 });
diff --git a/src/core/server/core_app/bundle_routes/register_bundle_routes.ts b/src/core/server/core_app/bundle_routes/register_bundle_routes.ts
index ee54f8ef34622..df46753747f5b 100644
--- a/src/core/server/core_app/bundle_routes/register_bundle_routes.ts
+++ b/src/core/server/core_app/bundle_routes/register_bundle_routes.ts
@@ -27,7 +27,7 @@ import { registerRouteForBundle } from './bundles_route';
  */
 export function registerBundleRoutes({
   router,
-  serverBasePath, // serverBasePath
+  serverBasePath,
   uiPlugins,
   packageInfo,
 }: {
@@ -57,10 +57,10 @@ export function registerBundleRoutes({
     isDist,
   });
 
-  [...uiPlugins.internal.entries()].forEach(([id, { publicTargetDir }]) => {
+  [...uiPlugins.internal.entries()].forEach(([id, { publicTargetDir, version }]) => {
     registerRouteForBundle(router, {
-      publicPath: `${serverBasePath}/${buildNum}/bundles/plugin/${id}/`,
-      routePath: `/${buildNum}/bundles/plugin/${id}/`,
+      publicPath: `${serverBasePath}/${buildNum}/bundles/plugin/${id}/${version}/`,
+      routePath: `/${buildNum}/bundles/plugin/${id}/${version}/`,
       bundlesPath: publicTargetDir,
       fileHashCache,
       isDist,
diff --git a/src/core/server/legacy/legacy_service.test.ts b/src/core/server/legacy/legacy_service.test.ts
index d0a02b9859960..67b5393f0b838 100644
--- a/src/core/server/legacy/legacy_service.test.ts
+++ b/src/core/server/legacy/legacy_service.test.ts
@@ -91,6 +91,7 @@ beforeEach(() => {
           'plugin-id',
           {
             requiredBundles: [],
+            version: '8.0.0',
             publicTargetDir: 'path/to/target/public',
             publicAssetsDir: '/plugins/name/assets/',
           },
diff --git a/src/core/server/plugins/plugins_service.test.ts b/src/core/server/plugins/plugins_service.test.ts
index 2d54648d22950..6bf7a1fadb4d3 100644
--- a/src/core/server/plugins/plugins_service.test.ts
+++ b/src/core/server/plugins/plugins_service.test.ts
@@ -562,12 +562,12 @@ describe('PluginsService', () => {
         plugin$: from([
           createPlugin('plugin-1', {
             path: 'path-1',
-            version: 'some-version',
+            version: 'version-1',
             configPath: 'plugin1',
           }),
           createPlugin('plugin-2', {
             path: 'path-2',
-            version: 'some-version',
+            version: 'version-2',
             configPath: 'plugin2',
           }),
         ]),
@@ -577,7 +577,7 @@ describe('PluginsService', () => {
     });
 
     describe('uiPlugins.internal', () => {
-      it('includes disabled plugins', async () => {
+      it('contains internal properties for plugins', async () => {
         config$.next({ plugins: { initialize: true }, plugin1: { enabled: false } });
         const { uiPlugins } = await pluginsService.discover({ environment: environmentSetup });
         expect(uiPlugins.internal).toMatchInlineSnapshot(`
@@ -586,15 +586,23 @@ describe('PluginsService', () => {
               "publicAssetsDir": <absolute path>/path-1/public/assets,
               "publicTargetDir": <absolute path>/path-1/target/public,
               "requiredBundles": Array [],
+              "version": "version-1",
             },
             "plugin-2" => Object {
               "publicAssetsDir": <absolute path>/path-2/public/assets,
               "publicTargetDir": <absolute path>/path-2/target/public,
               "requiredBundles": Array [],
+              "version": "version-2",
             },
           }
         `);
       });
+
+      it('includes disabled plugins', async () => {
+        config$.next({ plugins: { initialize: true }, plugin1: { enabled: false } });
+        const { uiPlugins } = await pluginsService.discover({ environment: environmentSetup });
+        expect([...uiPlugins.internal.keys()].sort()).toEqual(['plugin-1', 'plugin-2']);
+      });
     });
 
     describe('plugin initialization', () => {
diff --git a/src/core/server/plugins/plugins_service.ts b/src/core/server/plugins/plugins_service.ts
index 8b33e2cf4cc6b..09be40ecaf2a2 100644
--- a/src/core/server/plugins/plugins_service.ts
+++ b/src/core/server/plugins/plugins_service.ts
@@ -222,6 +222,7 @@ export class PluginsService implements CoreService<PluginsServiceSetup, PluginsS
           if (plugin.includesUiPlugin) {
             this.uiPluginInternalInfo.set(plugin.name, {
               requiredBundles: plugin.requiredBundles,
+              version: plugin.manifest.version,
               publicTargetDir: Path.resolve(plugin.path, 'target/public'),
               publicAssetsDir: Path.resolve(plugin.path, 'public/assets'),
             });
diff --git a/src/core/server/plugins/plugins_system.ts b/src/core/server/plugins/plugins_system.ts
index 0244254838fab..f6327d4eabf43 100644
--- a/src/core/server/plugins/plugins_system.ts
+++ b/src/core/server/plugins/plugins_system.ts
@@ -16,6 +16,7 @@ import { PluginsServiceSetupDeps, PluginsServiceStartDeps } from './plugins_serv
 import { PluginDependencies } from '.';
 
 const Sec = 1000;
+
 /** @internal */
 export class PluginsSystem {
   private readonly plugins = new Map<PluginName, PluginWrapper>();
diff --git a/src/core/server/plugins/types.ts b/src/core/server/plugins/types.ts
index a6086bd6f17e8..3a01049c5e1fe 100644
--- a/src/core/server/plugins/types.ts
+++ b/src/core/server/plugins/types.ts
@@ -224,12 +224,15 @@ export interface DiscoveredPlugin {
  */
 export interface InternalPluginInfo {
   /**
-   * Bundles that must be loaded for this plugoin
+   * Version of the plugin
+   */
+  readonly version: string;
+  /**
+   * Bundles that must be loaded for this plugin
    */
   readonly requiredBundles: readonly string[];
   /**
-   * Path to the target/public directory of the plugin which should be
-   * served
+   * Path to the target/public directory of the plugin which should be served
    */
   readonly publicTargetDir: string;
   /**
@@ -250,7 +253,9 @@ export interface Plugin<
   TPluginsStart extends object = object
 > {
   setup(core: CoreSetup, plugins: TPluginsSetup): TSetup;
+
   start(core: CoreStart, plugins: TPluginsStart): TStart;
+
   stop?(): void;
 }
 
@@ -267,7 +272,9 @@ export interface AsyncPlugin<
   TPluginsStart extends object = object
 > {
   setup(core: CoreSetup, plugins: TPluginsSetup): TSetup | Promise<TSetup>;
+
   start(core: CoreStart, plugins: TPluginsStart): TStart | Promise<TStart>;
+
   stop?(): void;
 }
 
diff --git a/src/core/server/rendering/bootstrap/get_plugin_bundle_paths.test.ts b/src/core/server/rendering/bootstrap/get_plugin_bundle_paths.test.ts
index ea3843884df31..0abd8fd5a0057 100644
--- a/src/core/server/rendering/bootstrap/get_plugin_bundle_paths.test.ts
+++ b/src/core/server/rendering/bootstrap/get_plugin_bundle_paths.test.ts
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import { UiPlugins } from '../../plugins';
+import { InternalPluginInfo, UiPlugins } from '../../plugins';
 import { getPluginsBundlePaths } from './get_plugin_bundle_paths';
 
 const createUiPlugins = (pluginDeps: Record<string, string[]>) => {
@@ -16,12 +16,13 @@ const createUiPlugins = (pluginDeps: Record<string, string[]>) => {
     browserConfigs: new Map(),
   };
 
-  Object.entries(pluginDeps).forEach(([pluginId, deps]) => {
+  const addPlugin = (pluginId: string, deps: string[]) => {
     uiPlugins.internal.set(pluginId, {
       requiredBundles: deps,
+      version: '8.0.0',
       publicTargetDir: '',
       publicAssetsDir: '',
-    } as any);
+    } as InternalPluginInfo);
     uiPlugins.public.set(pluginId, {
       id: pluginId,
       configPath: 'config-path',
@@ -29,6 +30,12 @@ const createUiPlugins = (pluginDeps: Record<string, string[]>) => {
       requiredPlugins: [],
       requiredBundles: deps,
     });
+
+    deps.forEach((dep) => addPlugin(dep, []));
+  };
+
+  Object.entries(pluginDeps).forEach(([pluginId, deps]) => {
+    addPlugin(pluginId, deps);
   });
 
   return uiPlugins;
@@ -56,13 +63,13 @@ describe('getPluginsBundlePaths', () => {
     });
 
     expect(pluginBundlePaths.get('a')).toEqual({
-      bundlePath: '/regular-bundle-path/plugin/a/a.plugin.js',
-      publicPath: '/regular-bundle-path/plugin/a/',
+      bundlePath: '/regular-bundle-path/plugin/a/8.0.0/a.plugin.js',
+      publicPath: '/regular-bundle-path/plugin/a/8.0.0/',
     });
 
     expect(pluginBundlePaths.get('b')).toEqual({
-      bundlePath: '/regular-bundle-path/plugin/b/b.plugin.js',
-      publicPath: '/regular-bundle-path/plugin/b/',
+      bundlePath: '/regular-bundle-path/plugin/b/8.0.0/b.plugin.js',
+      publicPath: '/regular-bundle-path/plugin/b/8.0.0/',
     });
   });
 });
diff --git a/src/core/server/rendering/bootstrap/get_plugin_bundle_paths.ts b/src/core/server/rendering/bootstrap/get_plugin_bundle_paths.ts
index c8291b2720a92..86ffdcf835f7b 100644
--- a/src/core/server/rendering/bootstrap/get_plugin_bundle_paths.ts
+++ b/src/core/server/rendering/bootstrap/get_plugin_bundle_paths.ts
@@ -25,9 +25,15 @@ export const getPluginsBundlePaths = ({
 
   while (pluginsToProcess.length > 0) {
     const pluginId = pluginsToProcess.pop() as string;
+    const plugin = uiPlugins.internal.get(pluginId);
+    if (!plugin) {
+      continue;
+    }
+    const { version } = plugin;
+
     pluginBundlePaths.set(pluginId, {
-      publicPath: `${regularBundlePath}/plugin/${pluginId}/`,
-      bundlePath: `${regularBundlePath}/plugin/${pluginId}/${pluginId}.plugin.js`,
+      publicPath: `${regularBundlePath}/plugin/${pluginId}/${version}/`,
+      bundlePath: `${regularBundlePath}/plugin/${pluginId}/${version}/${pluginId}.plugin.js`,
     });
 
     const pluginBundleIds = uiPlugins.internal.get(pluginId)?.requiredBundles ?? [];
diff --git a/src/core/server/server.api.md b/src/core/server/server.api.md
index de96c5ccfb81e..fb5fe3efd3e06 100644
--- a/src/core/server/server.api.md
+++ b/src/core/server/server.api.md
@@ -3259,9 +3259,9 @@ export const validBodyOutput: readonly ["data", "stream"];
 //
 // src/core/server/elasticsearch/client/types.ts:94:7 - (ae-forgotten-export) The symbol "Explanation" needs to be exported by the entry point index.d.ts
 // src/core/server/http/router/response.ts:297:3 - (ae-forgotten-export) The symbol "KibanaResponse" needs to be exported by the entry point index.d.ts
-// src/core/server/plugins/types.ts:286:3 - (ae-forgotten-export) The symbol "KibanaConfigType" needs to be exported by the entry point index.d.ts
-// src/core/server/plugins/types.ts:286:3 - (ae-forgotten-export) The symbol "SharedGlobalConfigKeys" needs to be exported by the entry point index.d.ts
-// src/core/server/plugins/types.ts:289:3 - (ae-forgotten-export) The symbol "SavedObjectsConfigType" needs to be exported by the entry point index.d.ts
-// src/core/server/plugins/types.ts:394:5 - (ae-unresolved-link) The @link reference could not be resolved: The package "kibana" does not have an export "create"
+// src/core/server/plugins/types.ts:293:3 - (ae-forgotten-export) The symbol "KibanaConfigType" needs to be exported by the entry point index.d.ts
+// src/core/server/plugins/types.ts:293:3 - (ae-forgotten-export) The symbol "SharedGlobalConfigKeys" needs to be exported by the entry point index.d.ts
+// src/core/server/plugins/types.ts:296:3 - (ae-forgotten-export) The symbol "SavedObjectsConfigType" needs to be exported by the entry point index.d.ts
+// src/core/server/plugins/types.ts:401:5 - (ae-unresolved-link) The @link reference could not be resolved: The package "kibana" does not have an export "create"
 
 ```

From 8e11e2598e874d603e99bcfac407ef9e09784102 Mon Sep 17 00:00:00 2001
From: Thomas Neirynck <thomas@elastic.co>
Date: Mon, 5 Apr 2021 12:04:20 -0400
Subject: [PATCH 14/17] [Maps] Enable all zoom levels for all users (#96093)

---
 .github/CODEOWNERS                            |   1 -
 docs/developer/plugin-list.asciidoc           |   4 -
 packages/kbn-optimizer/limits.yml             |   1 -
 .../service_settings/service_settings.test.js |  50 ++-------
 .../service_settings/service_settings.ts      |  17 +--
 .../service_settings_types.ts                 |   2 -
 src/plugins/maps_legacy/kibana.json           |   2 +-
 .../public/map/base_maps_visualization.js     |   3 +-
 .../maps_legacy/public/map/kibana_map.js      |  23 ----
 .../maps_legacy/public/map/map_messages.js    | 105 ------------------
 test/functional/apps/visualize/_tile_map.ts   |  59 ----------
 tsconfig.json                                 |   1 -
 tsconfig.refs.json                            |   1 -
 .../plugins/maps_legacy_licensing/README.md   |   4 -
 .../plugins/maps_legacy_licensing/kibana.json |   8 --
 .../maps_legacy_licensing/public/index.ts     |  12 --
 .../maps_legacy_licensing/public/plugin.ts    |  48 --------
 .../maps_legacy_licensing/tsconfig.json       |  15 ---
 .../translations/translations/ja-JP.json      |   1 -
 .../translations/translations/zh-CN.json      |   1 -
 20 files changed, 12 insertions(+), 346 deletions(-)
 delete mode 100644 src/plugins/maps_legacy/public/map/map_messages.js
 delete mode 100644 x-pack/plugins/maps_legacy_licensing/README.md
 delete mode 100644 x-pack/plugins/maps_legacy_licensing/kibana.json
 delete mode 100644 x-pack/plugins/maps_legacy_licensing/public/index.ts
 delete mode 100644 x-pack/plugins/maps_legacy_licensing/public/plugin.ts
 delete mode 100644 x-pack/plugins/maps_legacy_licensing/tsconfig.json

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index d14556ea1dabf..b9afc197bac9c 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -146,7 +146,6 @@
 /x-pack/test/visual_regression/tests/maps/index.js @elastic/kibana-gis
 #CC# /src/plugins/maps_legacy/ @elastic/kibana-gis
 #CC# /x-pack/plugins/file_upload @elastic/kibana-gis
-#CC# /x-pack/plugins/maps_legacy_licensing @elastic/kibana-gis
 /src/plugins/tile_map/ @elastic/kibana-gis
 /src/plugins/region_map/ @elastic/kibana-gis
 
diff --git a/docs/developer/plugin-list.asciidoc b/docs/developer/plugin-list.asciidoc
index bcf74936077ec..691d7fb82f3bc 100644
--- a/docs/developer/plugin-list.asciidoc
+++ b/docs/developer/plugin-list.asciidoc
@@ -452,10 +452,6 @@ using the CURL scripts in the scripts folder.
 |Visualize geo data from Elasticsearch or 3rd party geo-services.
 
 
-|{kib-repo}blob/{branch}/x-pack/plugins/maps_legacy_licensing/README.md[mapsLegacyLicensing]
-|This plugin provides access to the detailed tile map services from Elastic.
-
-
 |{kib-repo}blob/{branch}/x-pack/plugins/ml/readme.md[ml]
 |This plugin provides access to the machine learning features provided by
 Elastic.
diff --git a/packages/kbn-optimizer/limits.yml b/packages/kbn-optimizer/limits.yml
index 3c9fd4f59a406..a027768ad66a0 100644
--- a/packages/kbn-optimizer/limits.yml
+++ b/packages/kbn-optimizer/limits.yml
@@ -51,7 +51,6 @@ pageLoadAssetSize:
   management: 46112
   maps: 80000
   mapsLegacy: 87859
-  mapsLegacyLicensing: 20214
   ml: 82187
   monitoring: 80000
   navigation: 37269
diff --git a/src/plugins/maps_ems/public/service_settings/service_settings.test.js b/src/plugins/maps_ems/public/service_settings/service_settings.test.js
index 5bd371aace79b..eb67997c253b9 100644
--- a/src/plugins/maps_ems/public/service_settings/service_settings.test.js
+++ b/src/plugins/maps_ems/public/service_settings/service_settings.test.js
@@ -103,43 +103,8 @@ describe('service_settings (FKA tile_map test)', function () {
       expect(tmsService.attribution.includes('OpenStreetMap')).toEqual(true);
     });
 
-    describe('modify - url', function () {
-      let tilemapServices;
-
+    describe('tms mods', function () {
       let serviceSettings;
-      async function assertQuery(expected) {
-        const attrs = await serviceSettings.getAttributesForTMSLayer(tilemapServices[0]);
-        const urlObject = url.parse(attrs.url, true);
-        Object.keys(expected).forEach((key) => {
-          expect(urlObject.query[key]).toEqual(expected[key]);
-        });
-      }
-
-      it('accepts an object', async () => {
-        serviceSettings = makeServiceSettings();
-        serviceSettings.setQueryParams({ foo: 'bar' });
-        tilemapServices = await serviceSettings.getTMSServices();
-        await assertQuery({ foo: 'bar' });
-      });
-
-      it('merged additions with previous values', async () => {
-        // ensure that changes are always additive
-        serviceSettings = makeServiceSettings();
-        serviceSettings.setQueryParams({ foo: 'bar' });
-        serviceSettings.setQueryParams({ bar: 'stool' });
-        tilemapServices = await serviceSettings.getTMSServices();
-        await assertQuery({ foo: 'bar', bar: 'stool' });
-      });
-
-      it('overwrites conflicting previous values', async () => {
-        serviceSettings = makeServiceSettings();
-        // ensure that conflicts are overwritten
-        serviceSettings.setQueryParams({ foo: 'bar' });
-        serviceSettings.setQueryParams({ bar: 'stool' });
-        serviceSettings.setQueryParams({ foo: 'tstool' });
-        tilemapServices = await serviceSettings.getTMSServices();
-        await assertQuery({ foo: 'tstool', bar: 'stool' });
-      });
 
       it('should merge in tilemap url', async () => {
         serviceSettings = makeServiceSettings(
@@ -161,7 +126,7 @@ describe('service_settings (FKA tile_map test)', function () {
             id: 'road_map',
             name: 'Road Map - Bright',
             url:
-              'https://tiles.foobar/raster/styles/osm-bright/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=1.2.3',
+              'https://tiles.foobar/raster/styles/osm-bright/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=1.2.3&license=sspl',
             minZoom: 0,
             maxZoom: 10,
             attribution:
@@ -208,19 +173,19 @@ describe('service_settings (FKA tile_map test)', function () {
         );
 
         expect(desaturationFalse.url).toEqual(
-          'https://tiles.foobar/raster/styles/osm-bright/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=1.2.3'
+          'https://tiles.foobar/raster/styles/osm-bright/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=1.2.3&license=sspl'
         );
         expect(desaturationFalse.maxZoom).toEqual(10);
         expect(desaturationTrue.url).toEqual(
-          'https://tiles.foobar/raster/styles/osm-bright-desaturated/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=1.2.3'
+          'https://tiles.foobar/raster/styles/osm-bright-desaturated/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=1.2.3&license=sspl'
         );
         expect(desaturationTrue.maxZoom).toEqual(18);
         expect(darkThemeDesaturationFalse.url).toEqual(
-          'https://tiles.foobar/raster/styles/dark-matter/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=1.2.3'
+          'https://tiles.foobar/raster/styles/dark-matter/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=1.2.3&license=sspl'
         );
         expect(darkThemeDesaturationFalse.maxZoom).toEqual(22);
         expect(darkThemeDesaturationTrue.url).toEqual(
-          'https://tiles.foobar/raster/styles/dark-matter/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=1.2.3'
+          'https://tiles.foobar/raster/styles/dark-matter/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=1.2.3&license=sspl'
         );
         expect(darkThemeDesaturationTrue.maxZoom).toEqual(22);
       });
@@ -264,14 +229,13 @@ describe('service_settings (FKA tile_map test)', function () {
   describe('File layers', function () {
     it('should load manifest (all props)', async function () {
       const serviceSettings = makeServiceSettings();
-      serviceSettings.setQueryParams({ foo: 'bar' });
       const fileLayers = await serviceSettings.getFileLayers();
       expect(fileLayers.length).toEqual(19);
       const assertions = fileLayers.map(async function (fileLayer) {
         expect(fileLayer.origin).toEqual(ORIGIN.EMS);
         const fileUrl = await serviceSettings.getUrlForRegionLayer(fileLayer);
         const urlObject = url.parse(fileUrl, true);
-        Object.keys({ foo: 'bar', elastic_tile_service_tos: 'agree' }).forEach((key) => {
+        Object.keys({ elastic_tile_service_tos: 'agree' }).forEach((key) => {
           expect(typeof urlObject.query[key]).toEqual('string');
         });
       });
diff --git a/src/plugins/maps_ems/public/service_settings/service_settings.ts b/src/plugins/maps_ems/public/service_settings/service_settings.ts
index f7c735b6c3037..412db42a1570c 100644
--- a/src/plugins/maps_ems/public/service_settings/service_settings.ts
+++ b/src/plugins/maps_ems/public/service_settings/service_settings.ts
@@ -22,7 +22,6 @@ export class ServiceSettings implements IServiceSettings {
   private readonly _mapConfig: MapsEmsConfig;
   private readonly _tilemapsConfig: TileMapConfig;
   private readonly _hasTmsConfigured: boolean;
-  private _showZoomMessage: boolean;
   private readonly _emsClient: EMSClient;
   private readonly tmsOptionsFromConfig: any;
 
@@ -31,7 +30,6 @@ export class ServiceSettings implements IServiceSettings {
     this._tilemapsConfig = tilemapsConfig;
     this._hasTmsConfigured = typeof tilemapsConfig.url === 'string' && tilemapsConfig.url !== '';
 
-    this._showZoomMessage = true;
     this._emsClient = new EMSClient({
       language: i18n.getLocale(),
       appVersion: getKibanaVersion(),
@@ -45,6 +43,9 @@ export class ServiceSettings implements IServiceSettings {
         return fetch(...args);
       },
     });
+    // any kibana user, regardless of distribution, should get all zoom levels
+    // use `sspl` license to indicate this
+    this._emsClient.addQueryParams({ license: 'sspl' });
 
     const markdownIt = new MarkdownIt({
       html: false,
@@ -58,18 +59,6 @@ export class ServiceSettings implements IServiceSettings {
     });
   }
 
-  shouldShowZoomMessage({ origin }: { origin: string }): boolean {
-    return origin === ORIGIN.EMS && this._showZoomMessage;
-  }
-
-  enableZoomMessage(): void {
-    this._showZoomMessage = true;
-  }
-
-  disableZoomMessage(): void {
-    this._showZoomMessage = false;
-  }
-
   __debugStubManifestCalls(manifestRetrieval: () => Promise<unknown>): { removeStub: () => void } {
     const oldGetManifest = this._emsClient.getManifest;
 
diff --git a/src/plugins/maps_ems/public/service_settings/service_settings_types.ts b/src/plugins/maps_ems/public/service_settings/service_settings_types.ts
index 80a9aae835844..6b04bd200eba8 100644
--- a/src/plugins/maps_ems/public/service_settings/service_settings_types.ts
+++ b/src/plugins/maps_ems/public/service_settings/service_settings_types.ts
@@ -46,8 +46,6 @@ export interface IServiceSettings {
   getFileLayers(): Promise<FileLayer[]>;
   getUrlForRegionLayer(layer: FileLayer): Promise<string | undefined>;
   setQueryParams(params: { [p: string]: string }): void;
-  enableZoomMessage(): void;
-  disableZoomMessage(): void;
   getAttributesForTMSLayer(
     tmsServiceConfig: TmsLayer,
     isDesaturated: boolean,
diff --git a/src/plugins/maps_legacy/kibana.json b/src/plugins/maps_legacy/kibana.json
index 8e283288e34b2..f321274791a3b 100644
--- a/src/plugins/maps_legacy/kibana.json
+++ b/src/plugins/maps_legacy/kibana.json
@@ -5,5 +5,5 @@
   "ui": true,
   "server": true,
   "requiredPlugins": ["mapsEms"],
-  "requiredBundles": ["kibanaReact", "visDefaultEditor", "mapsEms"]
+  "requiredBundles": ["visDefaultEditor", "mapsEms"]
 }
diff --git a/src/plugins/maps_legacy/public/map/base_maps_visualization.js b/src/plugins/maps_legacy/public/map/base_maps_visualization.js
index 9cd574c5246e8..a261bcf6edd80 100644
--- a/src/plugins/maps_legacy/public/map/base_maps_visualization.js
+++ b/src/plugins/maps_legacy/public/map/base_maps_visualization.js
@@ -193,13 +193,12 @@ export function BaseMapsVisualizationProvider() {
         isDesaturated,
         isDarkMode
       );
-      const showZoomMessage = serviceSettings.shouldShowZoomMessage(tmsLayer);
       const options = { ...tmsLayer };
       delete options.id;
       delete options.subdomains;
       this._kibanaMap.setBaseLayer({
         baseLayerType: 'tms',
-        options: { ...options, showZoomMessage, ...meta },
+        options: { ...options, ...meta },
       });
     }
 
diff --git a/src/plugins/maps_legacy/public/map/kibana_map.js b/src/plugins/maps_legacy/public/map/kibana_map.js
index eea8315419289..62dbbda2588a5 100644
--- a/src/plugins/maps_legacy/public/map/kibana_map.js
+++ b/src/plugins/maps_legacy/public/map/kibana_map.js
@@ -7,13 +7,11 @@
  */
 
 import { EventEmitter } from 'events';
-import { createZoomWarningMsg } from './map_messages';
 import $ from 'jquery';
 import { get, isEqual, escape } from 'lodash';
 import { zoomToPrecision } from './zoom_to_precision';
 import { i18n } from '@kbn/i18n';
 import { ORIGIN } from '../../../maps_ems/common';
-import { getToasts } from '../kibana_services';
 import { L } from '../leaflet';
 
 function makeFitControl(fitContainer, kibanaMap) {
@@ -479,22 +477,6 @@ export class KibanaMap extends EventEmitter {
     this._updateLegend();
   }
 
-  _addMaxZoomMessage = (layer) => {
-    const zoomWarningMsg = createZoomWarningMsg(
-      getToasts(),
-      this.getZoomLevel,
-      this.getMaxZoomLevel
-    );
-
-    this._leafletMap.on('zoomend', zoomWarningMsg);
-    this._containerNode.setAttribute('data-test-subj', 'zoomWarningEnabled');
-
-    layer.on('remove', () => {
-      this._leafletMap.off('zoomend', zoomWarningMsg);
-      this._containerNode.removeAttribute('data-test-subj');
-    });
-  };
-
   setLegendPosition(position) {
     if (this._legendPosition === position) {
       if (!this._leafletLegendControl) {
@@ -572,11 +554,6 @@ export class KibanaMap extends EventEmitter {
       });
 
       this._leafletBaseLayer = baseLayer;
-      if (settings.options.showZoomMessage) {
-        baseLayer.on('add', () => {
-          this._addMaxZoomMessage(baseLayer);
-        });
-      }
       this._leafletBaseLayer.addTo(this._leafletMap);
       this._leafletBaseLayer.bringToBack();
       if (settings.options.minZoom > this._leafletMap.getZoom()) {
diff --git a/src/plugins/maps_legacy/public/map/map_messages.js b/src/plugins/maps_legacy/public/map/map_messages.js
deleted file mode 100644
index f60d819f0b390..0000000000000
--- a/src/plugins/maps_legacy/public/map/map_messages.js
+++ /dev/null
@@ -1,105 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import React from 'react';
-import { FormattedMessage } from '@kbn/i18n/react';
-import { EuiSpacer, EuiButtonEmpty } from '@elastic/eui';
-import { toMountPoint } from '../../../kibana_react/public';
-
-export const createZoomWarningMsg = (function () {
-  let disableZoomMsg = false;
-  const setZoomMsg = (boolDisableMsg) => (disableZoomMsg = boolDisableMsg);
-
-  class ZoomWarning extends React.Component {
-    constructor(props) {
-      super(props);
-      this.state = {
-        disabled: false,
-      };
-    }
-
-    render() {
-      return (
-        <div>
-          <p>
-            <FormattedMessage
-              id="maps_legacy.kibanaMap.zoomWarning"
-              defaultMessage="You've reached the maximum number of zoom
-              levels. To zoom all the way in, upgrade to the
-              {defaultDistribution} of Elasticsearch and Kibana. You'll get
-              access to additional zoom levels for free through the {ems}.
-              Or, you can configure your own map server. Please go to
-              { wms } or { configSettings} for more information."
-              values={{
-                defaultDistribution: (
-                  <a target="_blank" href="https://www.elastic.co/downloads/kibana">
-                    {`default distribution `}
-                  </a>
-                ),
-                ems: (
-                  <a target="_blank" href="https://www.elastic.co/elastic-maps-service">
-                    {`Elastic Maps Service`}
-                  </a>
-                ),
-                wms: (
-                  <a
-                    target="_blank"
-                    href="https://www.elastic.co/guide/en/kibana/current/tilemap.html"
-                  >
-                    {`Custom WMS Configuration`}
-                  </a>
-                ),
-                configSettings: (
-                  <a
-                    target="_blank"
-                    href="https://www.elastic.co/guide/en/kibana/current/settings.html"
-                  >
-                    {`Custom TMS Using Config Settings`}
-                  </a>
-                ),
-              }}
-            />
-          </p>
-          <EuiSpacer size="xs" />
-          <EuiButtonEmpty
-            size="s"
-            flush="left"
-            isDisabled={this.state.disabled}
-            onClick={() => {
-              this.setState(
-                {
-                  disabled: true,
-                },
-                () => this.props.onChange(this.state.disabled)
-              );
-            }}
-            data-test-subj="suppressZoomWarnings"
-          >
-            {`Don't show again`}
-          </EuiButtonEmpty>
-        </div>
-      );
-    }
-  }
-
-  const zoomToast = {
-    title: 'No additional zoom levels',
-    text: toMountPoint(<ZoomWarning onChange={setZoomMsg} />),
-    'data-test-subj': 'maxZoomWarning',
-  };
-
-  return (toastService, getZoomLevel, getMaxZoomLevel) => {
-    return () => {
-      const zoomLevel = getZoomLevel();
-      const maxMapZoom = getMaxZoomLevel();
-      if (!disableZoomMsg && zoomLevel === maxMapZoom) {
-        toastService.addDanger(zoomToast);
-      }
-    };
-  };
-})();
diff --git a/test/functional/apps/visualize/_tile_map.ts b/test/functional/apps/visualize/_tile_map.ts
index 668aec6ac5783..3af467affa1fb 100644
--- a/test/functional/apps/visualize/_tile_map.ts
+++ b/test/functional/apps/visualize/_tile_map.ts
@@ -15,7 +15,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const retry = getService('retry');
   const inspector = getService('inspector');
   const filterBar = getService('filterBar');
-  const testSubjects = getService('testSubjects');
   const browser = getService('browser');
   const PageObjects = getPageObjects([
     'common',
@@ -221,63 +220,5 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         });
       });
     });
-
-    describe('zoom warning behavior', function describeIndexTests() {
-      // Zoom warning is only applicable to OSS
-      this.tags(['skipCloud', 'skipFirefox']);
-
-      const waitForLoading = false;
-      let zoomWarningEnabled;
-      let last = false;
-      const toastDefaultLife = 6000;
-
-      before(async function () {
-        await browser.setWindowSize(1280, 1000);
-
-        log.debug('navigateToApp visualize');
-        await PageObjects.visualize.navigateToNewAggBasedVisualization();
-        log.debug('clickTileMap');
-        await PageObjects.visualize.clickTileMap();
-        await PageObjects.visualize.clickNewSearch();
-
-        zoomWarningEnabled = await testSubjects.exists('zoomWarningEnabled');
-        log.debug(`Zoom warning enabled: ${zoomWarningEnabled}`);
-
-        const zoomLevel = 9;
-        for (let i = 0; i < zoomLevel; i++) {
-          await PageObjects.tileMap.clickMapZoomIn();
-        }
-      });
-
-      beforeEach(async function () {
-        await PageObjects.tileMap.clickMapZoomIn(waitForLoading);
-      });
-
-      afterEach(async function () {
-        if (!last) {
-          await PageObjects.common.sleep(toastDefaultLife);
-          await PageObjects.tileMap.clickMapZoomOut(waitForLoading);
-        }
-      });
-
-      it('should show warning at zoom 10', async () => {
-        await testSubjects.existOrFail('maxZoomWarning');
-      });
-
-      it('should continue providing zoom warning if left alone', async () => {
-        await testSubjects.existOrFail('maxZoomWarning');
-      });
-
-      it('should suppress zoom warning if suppress warnings button clicked', async () => {
-        last = true;
-        await PageObjects.visChart.waitForVisualization();
-        await testSubjects.click('suppressZoomWarnings');
-        await PageObjects.tileMap.clickMapZoomOut(waitForLoading);
-        await testSubjects.waitForDeleted('suppressZoomWarnings');
-        await PageObjects.tileMap.clickMapZoomIn(waitForLoading);
-
-        await testSubjects.missingOrFail('maxZoomWarning');
-      });
-    });
   });
 }
diff --git a/tsconfig.json b/tsconfig.json
index 30944ac71fcc8..7c06e80858640 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -181,7 +181,6 @@
     { "path": "./x-pack/plugins/license_management/tsconfig.json" },
     { "path": "./x-pack/plugins/licensing/tsconfig.json" },
     { "path": "./x-pack/plugins/logstash/tsconfig.json" },
-    { "path": "./x-pack/plugins/maps_legacy_licensing/tsconfig.json" },
     { "path": "./x-pack/plugins/maps/tsconfig.json" },
     { "path": "./x-pack/plugins/ml/tsconfig.json" },
     { "path": "./x-pack/plugins/monitoring/tsconfig.json" },
diff --git a/tsconfig.refs.json b/tsconfig.refs.json
index 2d9ddc1b9e568..f13455a14b4df 100644
--- a/tsconfig.refs.json
+++ b/tsconfig.refs.json
@@ -85,7 +85,6 @@
     { "path": "./x-pack/plugins/license_management/tsconfig.json" },
     { "path": "./x-pack/plugins/licensing/tsconfig.json" },
     { "path": "./x-pack/plugins/logstash/tsconfig.json" },
-    { "path": "./x-pack/plugins/maps_legacy_licensing/tsconfig.json" },
     { "path": "./x-pack/plugins/maps/tsconfig.json" },
     { "path": "./x-pack/plugins/ml/tsconfig.json" },
     { "path": "./x-pack/plugins/monitoring/tsconfig.json" },
diff --git a/x-pack/plugins/maps_legacy_licensing/README.md b/x-pack/plugins/maps_legacy_licensing/README.md
deleted file mode 100644
index 7c2ce84d848d4..0000000000000
--- a/x-pack/plugins/maps_legacy_licensing/README.md
+++ /dev/null
@@ -1,4 +0,0 @@
-# Tile Map Plugin
-
-This plugin provides access to the detailed tile map services from Elastic.
-
diff --git a/x-pack/plugins/maps_legacy_licensing/kibana.json b/x-pack/plugins/maps_legacy_licensing/kibana.json
deleted file mode 100644
index 7a49e0aaa7be1..0000000000000
--- a/x-pack/plugins/maps_legacy_licensing/kibana.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "id": "mapsLegacyLicensing",
-  "version": "8.0.0",
-  "kibanaVersion": "kibana",
-  "server": false,
-  "ui": true,
-  "requiredPlugins": ["licensing", "mapsEms"]
-}
diff --git a/x-pack/plugins/maps_legacy_licensing/public/index.ts b/x-pack/plugins/maps_legacy_licensing/public/index.ts
deleted file mode 100644
index 9105919eaa635..0000000000000
--- a/x-pack/plugins/maps_legacy_licensing/public/index.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { MapsLegacyLicensing } from './plugin';
-
-export function plugin() {
-  return new MapsLegacyLicensing();
-}
diff --git a/x-pack/plugins/maps_legacy_licensing/public/plugin.ts b/x-pack/plugins/maps_legacy_licensing/public/plugin.ts
deleted file mode 100644
index f8118575cd6a2..0000000000000
--- a/x-pack/plugins/maps_legacy_licensing/public/plugin.ts
+++ /dev/null
@@ -1,48 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { CoreSetup, CoreStart, Plugin } from 'kibana/public';
-import { LicensingPluginSetup, ILicense } from '../../licensing/public';
-import { IServiceSettings, MapsEmsPluginSetup } from '../../../../src/plugins/maps_ems/public';
-
-/**
- * These are the interfaces with your public contracts. You should export these
- * for other plugins to use in _their_ `SetupDeps`/`StartDeps` interfaces.
- * @public
- */
-
-export interface MapsLegacyLicensingSetupDependencies {
-  licensing: LicensingPluginSetup;
-  mapsEms: MapsEmsPluginSetup;
-}
-// eslint-disable-next-line @typescript-eslint/no-empty-interface
-export interface MapsLegacyLicensingStartDependencies {}
-
-export type MapsLegacyLicensingSetup = ReturnType<MapsLegacyLicensing['setup']>;
-export type MapsLegacyLicensingStart = ReturnType<MapsLegacyLicensing['start']>;
-
-export class MapsLegacyLicensing
-  implements Plugin<MapsLegacyLicensingSetup, MapsLegacyLicensingStart> {
-  public setup(core: CoreSetup, plugins: MapsLegacyLicensingSetupDependencies) {
-    const { licensing, mapsEms } = plugins;
-    if (licensing) {
-      licensing.license$.subscribe(async (license: ILicense) => {
-        const serviceSettings: IServiceSettings = await mapsEms.getServiceSettings();
-        const { uid, isActive } = license;
-        if (isActive && license.hasAtLeast('basic')) {
-          serviceSettings.setQueryParams({ license: uid || '' });
-          serviceSettings.disableZoomMessage();
-        } else {
-          serviceSettings.setQueryParams({ license: '' });
-          serviceSettings.enableZoomMessage();
-        }
-      });
-    }
-  }
-
-  public start(core: CoreStart, plugins: MapsLegacyLicensingStartDependencies) {}
-}
diff --git a/x-pack/plugins/maps_legacy_licensing/tsconfig.json b/x-pack/plugins/maps_legacy_licensing/tsconfig.json
deleted file mode 100644
index 3b8102b5205a8..0000000000000
--- a/x-pack/plugins/maps_legacy_licensing/tsconfig.json
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-  "extends": "../../../tsconfig.project.json",
-  "compilerOptions": {
-    "composite": true,
-    "outDir": "./target/types",
-    "emitDeclarationOnly": true,
-    "declaration": true,
-    "declarationMap": true
-  },
-  "include": ["public/**/*"],
-  "references": [
-     { "path": "../licensing/tsconfig.json" },
-     { "path": "../../../src/plugins/maps_ems/tsconfig.json" }
-  ]
-}
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index 133b4d0b6aaa8..6dc490b4ffc53 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -3080,7 +3080,6 @@
     "maps_legacy.baseMapsVisualization.childShouldImplementMethodErrorMessage": "子はdata-updateに対応できるようこのメソッドを導入する必要があります",
     "maps_legacy.defaultDistributionMessage": "Mapsを入手するには、ElasticsearchとKibanaの{defaultDistribution}にアップグレードしてください。",
     "maps_legacy.kibanaMap.leaflet.fitDataBoundsAriaLabel": "データバウンドを合わせる",
-    "maps_legacy.kibanaMap.zoomWarning": "ズームレベルが最大に達しました。完全にズームインするには、ElasticsearchとKibanaの{defaultDistribution}にアップグレードしてください。{ems}ではより多くのズームレベルを無料で利用できます。または、独自のマップサーバーを構成できます。詳細は、{ wms }または{ configSettings}をご覧ください。",
     "maps_legacy.legacyMapDeprecationMessage": "Mapsを使用すると、複数のレイヤーとインデックスを追加する、個別のドキュメントをプロットする、データ値から特徴を表現する、ヒートマップ、グリッド、クラスターを追加するなど、さまざまなことが可能です。{getMapsMessage}",
     "maps_legacy.legacyMapDeprecationTitle": "{label}は8.0でMapsに移行されます。",
     "maps_legacy.openInMapsButtonLabel": "Mapsで表示",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 0f9d8b90a2578..32574690b13f2 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -3101,7 +3101,6 @@
     "maps_legacy.baseMapsVisualization.childShouldImplementMethodErrorMessage": "子对象应实现此方法以响应数据更新",
     "maps_legacy.defaultDistributionMessage": "要获取 Maps，请升级到 {defaultDistribution} 版的 Elasticsearch 和 Kibana。",
     "maps_legacy.kibanaMap.leaflet.fitDataBoundsAriaLabel": "适应数据边界",
-    "maps_legacy.kibanaMap.zoomWarning": "已达到缩放级别数目上限。要一直放大，请升级到 Elasticsearch 和 Kibana 的{defaultDistribution}。您可以通过 {ems} 免费使用其他缩放级别。或者，您可以配置自己的地图服务器。请前往 { wms } 或 { configSettings} 以获取详细信息。",
     "maps_legacy.legacyMapDeprecationMessage": "使用 Maps，可以添加多个图层和索引，绘制单个文档，使用数据值表示特征，添加热图、网格和集群，等等。{getMapsMessage}",
     "maps_legacy.legacyMapDeprecationTitle": "在 8.0 中，{label} 将迁移到 Maps。",
     "maps_legacy.openInMapsButtonLabel": "在 Maps 中查看",

From bcb72c596a438f6a223e875395380afe1efc291c Mon Sep 17 00:00:00 2001
From: Andrew Goldstein <andrew-goldstein@users.noreply.github.com>
Date: Mon, 5 Apr 2021 11:39:09 -0600
Subject: [PATCH 15/17] [RAC][Alert Triage][TGrid] Update the Alerts Table
 (TGrid) API to implement `renderCellValue` (#96098)

### [RAC][Alert Triage][TGrid] Update the Alerts Table (TGrid) API to implement `renderCellValue`

- This PR implements a superset of the `renderCellValue` API from [EuiDataGrid](https://elastic.github.io/eui/#/tabular-content/data-grid) in the `TGrid` (Timeline grid) API

- The TGrid API was also updated to accept a collection of `RowRenderer`s as a prop

The API changes are summarized by the following screenshot:

<img width="1239" alt="render-cell-value" src="https://user-images.githubusercontent.com/4459398/113345484-c121f800-92ef-11eb-8a21-2b6dd8ef499b.png">

The following screenshot shows the `signal.rule.risk_score` column in the Alerts table being rendered with a green background color, using the same technique illustrated by `EuiDataGrid`'s [codesandbox example](https://codesandbox.io/s/nsmzs):

<img width="1231" alt="alerts" src="https://user-images.githubusercontent.com/4459398/113349015-a30ac680-92f4-11eb-8518-5c1b7465e76e.png">

Note: In the screenshot above, the values in the Alerts table are also _not_ rendered as draggables.

Related (RAC) issue: https://github.com/elastic/kibana/issues/94520

### Details

The `StatefulEventsViewer` has been updated to accept `renderCellValue` as a (required) prop:

```
renderCellValue: (props: CellValueElementProps) => React.ReactNode;
```

The type definition of `CellValueElementProps` is:

```
export type CellValueElementProps = EuiDataGridCellValueElementProps & {
  data: TimelineNonEcsData[];
  eventId: string; // _id
  header: ColumnHeaderOptions;
  linkValues: string[] | undefined;
  timelineId: string;
};
```

The `CellValueElementProps` type above is a _superset_ of `EuiDataGridCellValueElementProps`. The additional properties above include the `data` returned by the TGrid when it performs IO to retrieve alerts and events.

### Using `renderCellValue` to control rendering

The internal implementation of TGrid's cell rendering didn't change with this PR; it moved to

`x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/default_cell_renderer.tsx` as shown below:

```
export const DefaultCellRenderer: React.FC<CellValueElementProps> = ({
  columnId,
  data,
  eventId,
  header,
  linkValues,
  setCellProps,
  timelineId,
}) => (
  <>
    {getColumnRenderer(header.id, columnRenderers, data).renderColumn({
      columnName: header.id,
      eventId,
      field: header,
      linkValues,
      timelineId,
      truncate: true,
      values: getMappedNonEcsValue({
        data,
        fieldName: header.id,
      }),
    })}
  </>
);
```

Any usages of TGrid were updated to pass `DefaultCellRenderer` as the value of the `renderCellValue` prop, as shown in the screenshot below:

<img width="1239" alt="render-cell-value" src="https://user-images.githubusercontent.com/4459398/113345484-c121f800-92ef-11eb-8a21-2b6dd8ef499b.png">

The `EuiDataGrid` [codesandbox example](https://codesandbox.io/s/nsmzs) provides the following example `renderCellValue` implementation, which highlights a cell green based on it's numeric value:

```
  const renderCellValue = useMemo(() => {
    return ({ rowIndex, columnId, setCellProps }) => {
      const data = useContext(DataContext);
      useEffect(() => {
        if (columnId === 'amount') {
          if (data.hasOwnProperty(rowIndex)) {
            const numeric = parseFloat(
              data[rowIndex][columnId].match(/\d+\.\d+/)[0],
              10
            );
            setCellProps({
              style: {
                backgroundColor: `rgba(0, 255, 0, ${numeric * 0.0002})`,
              },
            });
          }
        }
      }, [rowIndex, columnId, setCellProps, data]);

      function getFormatted() {
        return data[rowIndex][columnId].formatted
          ? data[rowIndex][columnId].formatted
          : data[rowIndex][columnId];
      }

      return data.hasOwnProperty(rowIndex)
        ? getFormatted(rowIndex, columnId)
        : null;
    };
  }, []);
```

The sample code above formats the `amount` column in the example `EuiDataGrid` with a green `backgroundColor` based on the value of the data, as shown in the screenshot below:

<img width="956" alt="datagrid-cell-formatting" src="https://user-images.githubusercontent.com/4459398/113348300-a782af80-92f3-11eb-896a-3d92cf4b9b53.png">

To demonstrate that similar styling can be applied to TGrid using the same technique illustrated by `EuiDataGrid`'s [codesandbox example](https://codesandbox.io/s/nsmzs), we can update the `DefaultCellRenderer` in `x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/default_cell_renderer.tsx` to apply a similar technique:

```
export const DefaultCellRenderer: React.FC<CellValueElementProps> = ({
  columnId,
  data,
  eventId,
  header,
  linkValues,
  setCellProps,
  timelineId,
}) => {
  useEffect(() => {
    if (columnId === 'signal.rule.risk_score') {
      const value = getMappedNonEcsValue({
        data,
        fieldName: columnId,
      });
      if (Array.isArray(value) && value.length > 0) {
        const numeric = parseFloat(value[0]);
        setCellProps({
          style: {
            backgroundColor: `rgba(0, 255, 0, ${numeric * 0.002})`,
          },
        });
      }
    }
  }, [columnId, data, setCellProps]);

  return (
    <>
      {getMappedNonEcsValue({
        data,
        fieldName: columnId,
      })}
    </>
  );
};
```

The example code above renders the  `signal.rule.risk_score` column in the Alerts table with a green `backgroundColor` based on the value of the data, as shown in the screenshot below:

<img width="1231" alt="alerts" src="https://user-images.githubusercontent.com/4459398/113349015-a30ac680-92f4-11eb-8518-5c1b7465e76e.png">

Note: In the screenshot above, the values in the Alerts table are not rendered as draggables.
---
 .../components/alerts_viewer/alerts_table.tsx |   4 +
 .../events_viewer/events_viewer.test.tsx      |   6 +
 .../events_viewer/events_viewer.tsx           |  14 +-
 .../components/events_viewer/index.test.tsx   |   4 +
 .../common/components/events_viewer/index.tsx |  13 +-
 .../components/alerts_table/index.tsx         |   4 +
 .../navigation/events_query_tab_body.tsx      |   4 +
 .../components/flyout/pane/index.tsx          |   8 +-
 .../__snapshots__/index.test.tsx.snap         | 553 ++++++++--
 .../body/data_driven_columns/index.test.tsx   |   4 +-
 .../body/data_driven_columns/index.tsx        |  30 +-
 .../stateful_cell.test.tsx                    | 171 +++
 .../data_driven_columns/stateful_cell.tsx     |  63 ++
 .../body/events/event_column_view.test.tsx    |   2 +
 .../body/events/event_column_view.tsx         |   8 +-
 .../components/timeline/body/events/index.tsx |   8 +-
 .../timeline/body/events/stateful_event.tsx   |  10 +-
 .../components/timeline/body/index.test.tsx   |   8 +-
 .../components/timeline/body/index.tsx        |  13 +-
 .../body/renderers/get_row_renderer.test.tsx  |  16 +-
 .../timeline/body/renderers/index.ts          |   2 +-
 .../default_cell_renderer.test.tsx            | 107 ++
 .../cell_rendering/default_cell_renderer.tsx  |  39 +
 .../timeline/cell_rendering/index.tsx         |  20 +
 .../__snapshots__/index.test.tsx.snap         | 980 ++++++++++++++++++
 .../timeline/eql_tab_content/index.test.tsx   |   4 +
 .../timeline/eql_tab_content/index.tsx        |   8 +
 .../components/timeline/index.test.tsx        |   4 +
 .../timelines/components/timeline/index.tsx   |  14 +-
 .../__snapshots__/index.test.tsx.snap         | 980 ++++++++++++++++++
 .../pinned_tab_content/index.test.tsx         |   5 +-
 .../timeline/pinned_tab_content/index.tsx     |   8 +
 .../__snapshots__/index.test.tsx.snap         | 980 ++++++++++++++++++
 .../timeline/query_tab_content/index.test.tsx |   4 +
 .../timeline/query_tab_content/index.tsx      |   8 +
 .../timeline/tabs_content/index.tsx           |  64 +-
 .../timeline/epic_local_storage.test.tsx      |   5 +-
 37 files changed, 4047 insertions(+), 128 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/public/timelines/components/timeline/body/data_driven_columns/stateful_cell.test.tsx
 create mode 100644 x-pack/plugins/security_solution/public/timelines/components/timeline/body/data_driven_columns/stateful_cell.tsx
 create mode 100644 x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/default_cell_renderer.test.tsx
 create mode 100644 x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/default_cell_renderer.tsx
 create mode 100644 x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/index.tsx

diff --git a/x-pack/plugins/security_solution/public/common/components/alerts_viewer/alerts_table.tsx b/x-pack/plugins/security_solution/public/common/components/alerts_viewer/alerts_table.tsx
index af90d17fe62b8..43d5c66655808 100644
--- a/x-pack/plugins/security_solution/public/common/components/alerts_viewer/alerts_table.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/alerts_viewer/alerts_table.tsx
@@ -12,6 +12,8 @@ import { TimelineIdLiteral } from '../../../../common/types/timeline';
 import { StatefulEventsViewer } from '../events_viewer';
 import { alertsDefaultModel } from './default_headers';
 import { useManageTimeline } from '../../../timelines/components/manage_timeline';
+import { defaultRowRenderers } from '../../../timelines/components/timeline/body/renderers';
+import { DefaultCellRenderer } from '../../../timelines/components/timeline/cell_rendering/default_cell_renderer';
 import * as i18n from './translations';
 import { useKibana } from '../../lib/kibana';
 import { SourcererScopeName } from '../../store/sourcerer/model';
@@ -91,6 +93,8 @@ const AlertsTableComponent: React.FC<Props> = ({
       defaultModel={alertsDefaultModel}
       end={endDate}
       id={timelineId}
+      renderCellValue={DefaultCellRenderer}
+      rowRenderers={defaultRowRenderers}
       scopeId={SourcererScopeName.default}
       start={startDate}
     />
diff --git a/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.test.tsx b/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.test.tsx
index 3ecc17589fe08..8962f5e6c5146 100644
--- a/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.test.tsx
@@ -26,6 +26,8 @@ import { KqlMode } from '../../../timelines/store/timeline/model';
 import { SortDirection } from '../../../timelines/components/timeline/body/sort';
 import { AlertsTableFilterGroup } from '../../../detections/components/alerts_table/alerts_filter_group';
 import { SourcererScopeName } from '../../store/sourcerer/model';
+import { defaultRowRenderers } from '../../../timelines/components/timeline/body/renderers';
+import { DefaultCellRenderer } from '../../../timelines/components/timeline/cell_rendering/default_cell_renderer';
 import { useTimelineEvents } from '../../../timelines/containers';
 
 jest.mock('../../../timelines/components/graph_overlay', () => ({
@@ -99,6 +101,8 @@ const eventsViewerDefaultProps = {
     query: '',
     language: 'kql',
   },
+  renderCellValue: DefaultCellRenderer,
+  rowRenderers: defaultRowRenderers,
   start: from,
   sort: [
     {
@@ -118,6 +122,8 @@ describe('EventsViewer', () => {
     defaultModel: eventsDefaultModel,
     end: to,
     id: TimelineId.test,
+    renderCellValue: DefaultCellRenderer,
+    rowRenderers: defaultRowRenderers,
     start: from,
     scopeId: SourcererScopeName.timeline,
   };
diff --git a/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.tsx b/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.tsx
index 050cd92b0556e..e6e868f1a7365 100644
--- a/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.tsx
@@ -4,7 +4,6 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
 import { EuiFlexGroup, EuiFlexItem, EuiPanel } from '@elastic/eui';
 import { isEmpty } from 'lodash/fp';
 import React, { useEffect, useMemo, useState } from 'react';
@@ -41,7 +40,9 @@ import { useManageTimeline } from '../../../timelines/components/manage_timeline
 import { ExitFullScreen } from '../exit_full_screen';
 import { useGlobalFullScreen } from '../../containers/use_full_screen';
 import { TimelineId, TimelineTabs } from '../../../../common/types/timeline';
+import { RowRenderer } from '../../../timelines/components/timeline/body/renderers/row_renderer';
 import { GraphOverlay } from '../../../timelines/components/graph_overlay';
+import { CellValueElementProps } from '../../../timelines/components/timeline/cell_rendering';
 import { SELECTOR_TIMELINE_GLOBAL_CONTAINER } from '../../../timelines/components/timeline/styles';
 
 export const EVENTS_VIEWER_HEADER_HEIGHT = 90; // px
@@ -122,6 +123,8 @@ interface Props {
   kqlMode: KqlMode;
   query: Query;
   onRuleChange?: () => void;
+  renderCellValue: (props: CellValueElementProps) => React.ReactNode;
+  rowRenderers: RowRenderer[];
   start: string;
   sort: Sort[];
   utilityBar?: (refetch: inputsModel.Refetch, totalCount: number) => React.ReactNode;
@@ -146,8 +149,10 @@ const EventsViewerComponent: React.FC<Props> = ({
   itemsPerPage,
   itemsPerPageOptions,
   kqlMode,
-  query,
   onRuleChange,
+  query,
+  renderCellValue,
+  rowRenderers,
   start,
   sort,
   utilityBar,
@@ -310,6 +315,8 @@ const EventsViewerComponent: React.FC<Props> = ({
                     isEventViewer={true}
                     onRuleChange={onRuleChange}
                     refetch={refetch}
+                    renderCellValue={renderCellValue}
+                    rowRenderers={rowRenderers}
                     sort={sort}
                     tabType={TimelineTabs.query}
                     totalPages={calculateTotalPages({
@@ -343,6 +350,7 @@ const EventsViewerComponent: React.FC<Props> = ({
 
 export const EventsViewer = React.memo(
   EventsViewerComponent,
+  // eslint-disable-next-line complexity
   (prevProps, nextProps) =>
     deepEqual(prevProps.browserFields, nextProps.browserFields) &&
     prevProps.columns === nextProps.columns &&
@@ -359,6 +367,8 @@ export const EventsViewer = React.memo(
     prevProps.itemsPerPageOptions === nextProps.itemsPerPageOptions &&
     prevProps.kqlMode === nextProps.kqlMode &&
     deepEqual(prevProps.query, nextProps.query) &&
+    prevProps.renderCellValue === nextProps.renderCellValue &&
+    prevProps.rowRenderers === nextProps.rowRenderers &&
     prevProps.start === nextProps.start &&
     deepEqual(prevProps.sort, nextProps.sort) &&
     prevProps.utilityBar === nextProps.utilityBar &&
diff --git a/x-pack/plugins/security_solution/public/common/components/events_viewer/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/events_viewer/index.test.tsx
index 5004c23f9111c..cd27177643b44 100644
--- a/x-pack/plugins/security_solution/public/common/components/events_viewer/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/events_viewer/index.test.tsx
@@ -18,7 +18,9 @@ import { StatefulEventsViewer } from '.';
 import { eventsDefaultModel } from './default_model';
 import { TimelineId } from '../../../../common/types/timeline';
 import { SourcererScopeName } from '../../store/sourcerer/model';
+import { DefaultCellRenderer } from '../../../timelines/components/timeline/cell_rendering/default_cell_renderer';
 import { useTimelineEvents } from '../../../timelines/containers';
+import { defaultRowRenderers } from '../../../timelines/components/timeline/body/renderers';
 
 jest.mock('../../../timelines/containers', () => ({
   useTimelineEvents: jest.fn(),
@@ -38,6 +40,8 @@ const testProps = {
   end: to,
   indexNames: [],
   id: TimelineId.test,
+  renderCellValue: DefaultCellRenderer,
+  rowRenderers: defaultRowRenderers,
   scopeId: SourcererScopeName.default,
   start: from,
 };
diff --git a/x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx b/x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx
index 59dc756bb2b3e..b58aa2236d292 100644
--- a/x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx
@@ -22,6 +22,8 @@ import { useGlobalFullScreen } from '../../containers/use_full_screen';
 import { SourcererScopeName } from '../../store/sourcerer/model';
 import { useSourcererScope } from '../../containers/sourcerer';
 import { DetailsPanel } from '../../../timelines/components/side_panel';
+import { RowRenderer } from '../../../timelines/components/timeline/body/renderers/row_renderer';
+import { CellValueElementProps } from '../../../timelines/components/timeline/cell_rendering';
 
 const DEFAULT_EVENTS_VIEWER_HEIGHT = 652;
 
@@ -41,6 +43,8 @@ export interface OwnProps {
   headerFilterGroup?: React.ReactNode;
   pageFilters?: Filter[];
   onRuleChange?: () => void;
+  renderCellValue: (props: CellValueElementProps) => React.ReactNode;
+  rowRenderers: RowRenderer[];
   utilityBar?: (refetch: inputsModel.Refetch, totalCount: number) => React.ReactNode;
 }
 
@@ -67,8 +71,10 @@ const StatefulEventsViewerComponent: React.FC<Props> = ({
   itemsPerPageOptions,
   kqlMode,
   pageFilters,
-  query,
   onRuleChange,
+  query,
+  renderCellValue,
+  rowRenderers,
   start,
   scopeId,
   showCheckboxes,
@@ -129,6 +135,8 @@ const StatefulEventsViewerComponent: React.FC<Props> = ({
             kqlMode={kqlMode}
             query={query}
             onRuleChange={onRuleChange}
+            renderCellValue={renderCellValue}
+            rowRenderers={rowRenderers}
             start={start}
             sort={sort}
             utilityBar={utilityBar}
@@ -201,6 +209,7 @@ type PropsFromRedux = ConnectedProps<typeof connector>;
 export const StatefulEventsViewer = connector(
   React.memo(
     StatefulEventsViewerComponent,
+    // eslint-disable-next-line complexity
     (prevProps, nextProps) =>
       prevProps.id === nextProps.id &&
       prevProps.scopeId === nextProps.scopeId &&
@@ -215,6 +224,8 @@ export const StatefulEventsViewer = connector(
       deepEqual(prevProps.itemsPerPageOptions, nextProps.itemsPerPageOptions) &&
       prevProps.kqlMode === nextProps.kqlMode &&
       deepEqual(prevProps.query, nextProps.query) &&
+      prevProps.renderCellValue === nextProps.renderCellValue &&
+      prevProps.rowRenderers === nextProps.rowRenderers &&
       deepEqual(prevProps.sort, nextProps.sort) &&
       prevProps.start === nextProps.start &&
       deepEqual(prevProps.pageFilters, nextProps.pageFilters) &&
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx
index 6c88b8e29800b..cf6db52d0cece 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx
@@ -48,6 +48,8 @@ import {
 import { SourcererScopeName } from '../../../common/store/sourcerer/model';
 import { useSourcererScope } from '../../../common/containers/sourcerer';
 import { buildTimeRangeFilter } from './helpers';
+import { DefaultCellRenderer } from '../../../timelines/components/timeline/cell_rendering/default_cell_renderer';
+import { defaultRowRenderers } from '../../../timelines/components/timeline/body/renderers';
 
 interface OwnProps {
   timelineId: TimelineIdLiteral;
@@ -336,6 +338,8 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
       headerFilterGroup={headerFilterGroup}
       id={timelineId}
       onRuleChange={onRuleChange}
+      renderCellValue={DefaultCellRenderer}
+      rowRenderers={defaultRowRenderers}
       scopeId={SourcererScopeName.detections}
       start={from}
       utilityBar={utilityBarCallback}
diff --git a/x-pack/plugins/security_solution/public/hosts/pages/navigation/events_query_tab_body.tsx b/x-pack/plugins/security_solution/public/hosts/pages/navigation/events_query_tab_body.tsx
index 922d52b6cfe5a..f88709e6e95ac 100644
--- a/x-pack/plugins/security_solution/public/hosts/pages/navigation/events_query_tab_body.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/pages/navigation/events_query_tab_body.tsx
@@ -21,6 +21,8 @@ import { useGlobalFullScreen } from '../../../common/containers/use_full_screen'
 import * as i18n from '../translations';
 import { MatrixHistogramType } from '../../../../common/search_strategy/security_solution';
 import { useManageTimeline } from '../../../timelines/components/manage_timeline';
+import { defaultRowRenderers } from '../../../timelines/components/timeline/body/renderers';
+import { DefaultCellRenderer } from '../../../timelines/components/timeline/cell_rendering/default_cell_renderer';
 import { SourcererScopeName } from '../../../common/store/sourcerer/model';
 
 const EVENTS_HISTOGRAM_ID = 'eventsHistogramQuery';
@@ -96,6 +98,8 @@ const EventsQueryTabBodyComponent: React.FC<HostsComponentsQueryProps> = ({
         defaultModel={eventsDefaultModel}
         end={endDate}
         id={TimelineId.hostsPageEvents}
+        renderCellValue={DefaultCellRenderer}
+        rowRenderers={defaultRowRenderers}
         scopeId={SourcererScopeName.default}
         start={startDate}
         pageFilters={pageFilters}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/flyout/pane/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/flyout/pane/index.tsx
index e63ffedf3da7c..459706de36569 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/flyout/pane/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/flyout/pane/index.tsx
@@ -14,6 +14,8 @@ import { StatefulTimeline } from '../../timeline';
 import { TimelineId } from '../../../../../common/types/timeline';
 import * as i18n from './translations';
 import { timelineActions } from '../../../store/timeline';
+import { defaultRowRenderers } from '../../timeline/body/renderers';
+import { DefaultCellRenderer } from '../../timeline/cell_rendering/default_cell_renderer';
 import { focusActiveTimelineButton } from '../../timeline/helpers';
 
 interface FlyoutPaneComponentProps {
@@ -46,7 +48,11 @@ const FlyoutPaneComponent: React.FC<FlyoutPaneComponentProps> = ({ timelineId })
         onClose={handleClose}
         size="l"
       >
-        <StatefulTimeline timelineId={timelineId} />
+        <StatefulTimeline
+          renderCellValue={DefaultCellRenderer}
+          rowRenderers={defaultRowRenderers}
+          timelineId={timelineId}
+        />
       </EuiFlyout>
     </EuiFlyoutContainer>
   );
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/data_driven_columns/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/data_driven_columns/__snapshots__/index.test.tsx.snap
index 72d2956bd4086..91d039a19495c 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/data_driven_columns/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/data_driven_columns/__snapshots__/index.test.tsx.snap
@@ -22,26 +22,77 @@ exports[`Columns it renders the expected columns 1`] = `
           You are in a table cell. row: 2, column: 2
         </p>
       </EuiScreenReaderOnly>
-      <DraggableWrapper
-        dataProvider={
-          Object {
-            "and": Array [],
-            "enabled": true,
-            "excluded": true,
-            "id": "empty-column-renderer-draggable-wrapper-test-message-1-message",
-            "kqlQuery": "",
-            "name": "message: ",
-            "queryMatch": Object {
-              "displayValue": "—",
-              "field": "message",
-              "operator": ":*",
-              "value": "",
+      <Memo(StatefulCellComponent)
+        ariaRowindex={2}
+        data={
+          Array [
+            Object {
+              "field": "@timestamp",
+              "value": Array [
+                "2018-11-05T19:03:25.937Z",
+              ],
+            },
+            Object {
+              "field": "event.severity",
+              "value": Array [
+                "3",
+              ],
+            },
+            Object {
+              "field": "event.category",
+              "value": Array [
+                "Access",
+              ],
+            },
+            Object {
+              "field": "event.action",
+              "value": Array [
+                "Action",
+              ],
+            },
+            Object {
+              "field": "host.name",
+              "value": Array [
+                "apache",
+              ],
+            },
+            Object {
+              "field": "source.ip",
+              "value": Array [
+                "192.168.0.1",
+              ],
             },
+            Object {
+              "field": "destination.ip",
+              "value": Array [
+                "192.168.0.3",
+              ],
+            },
+            Object {
+              "field": "destination.bytes",
+              "value": Array [
+                "123456",
+              ],
+            },
+            Object {
+              "field": "user.name",
+              "value": Array [
+                "john.dee",
+              ],
+            },
+          ]
+        }
+        eventId="1"
+        header={
+          Object {
+            "columnHeaderType": "not-filtered",
+            "id": "message",
+            "width": 180,
           }
         }
-        key="empty-column-renderer-draggable-wrapper-test-message-1-message"
-        render={[Function]}
-        truncate={true}
+        linkValues={Array []}
+        renderCellValue={[Function]}
+        timelineId="test"
       />
     </styled.div>
   </styled.div>
@@ -63,15 +114,77 @@ exports[`Columns it renders the expected columns 1`] = `
           You are in a table cell. row: 2, column: 3
         </p>
       </EuiScreenReaderOnly>
-      <Memo(FormattedFieldValueComponent)
-        contextId="plain-column-renderer-formatted-field-value-test"
+      <Memo(StatefulCellComponent)
+        ariaRowindex={2}
+        data={
+          Array [
+            Object {
+              "field": "@timestamp",
+              "value": Array [
+                "2018-11-05T19:03:25.937Z",
+              ],
+            },
+            Object {
+              "field": "event.severity",
+              "value": Array [
+                "3",
+              ],
+            },
+            Object {
+              "field": "event.category",
+              "value": Array [
+                "Access",
+              ],
+            },
+            Object {
+              "field": "event.action",
+              "value": Array [
+                "Action",
+              ],
+            },
+            Object {
+              "field": "host.name",
+              "value": Array [
+                "apache",
+              ],
+            },
+            Object {
+              "field": "source.ip",
+              "value": Array [
+                "192.168.0.1",
+              ],
+            },
+            Object {
+              "field": "destination.ip",
+              "value": Array [
+                "192.168.0.3",
+              ],
+            },
+            Object {
+              "field": "destination.bytes",
+              "value": Array [
+                "123456",
+              ],
+            },
+            Object {
+              "field": "user.name",
+              "value": Array [
+                "john.dee",
+              ],
+            },
+          ]
+        }
         eventId="1"
-        fieldFormat=""
-        fieldName="event.category"
-        fieldType=""
-        key="plain-column-renderer-formatted-field-value-test-event.category-1-event.category-Access-0"
-        truncate={true}
-        value="Access"
+        header={
+          Object {
+            "columnHeaderType": "not-filtered",
+            "id": "event.category",
+            "width": 180,
+          }
+        }
+        linkValues={Array []}
+        renderCellValue={[Function]}
+        timelineId="test"
       />
     </styled.div>
   </styled.div>
@@ -93,15 +206,77 @@ exports[`Columns it renders the expected columns 1`] = `
           You are in a table cell. row: 2, column: 4
         </p>
       </EuiScreenReaderOnly>
-      <Memo(FormattedFieldValueComponent)
-        contextId="plain-column-renderer-formatted-field-value-test"
+      <Memo(StatefulCellComponent)
+        ariaRowindex={2}
+        data={
+          Array [
+            Object {
+              "field": "@timestamp",
+              "value": Array [
+                "2018-11-05T19:03:25.937Z",
+              ],
+            },
+            Object {
+              "field": "event.severity",
+              "value": Array [
+                "3",
+              ],
+            },
+            Object {
+              "field": "event.category",
+              "value": Array [
+                "Access",
+              ],
+            },
+            Object {
+              "field": "event.action",
+              "value": Array [
+                "Action",
+              ],
+            },
+            Object {
+              "field": "host.name",
+              "value": Array [
+                "apache",
+              ],
+            },
+            Object {
+              "field": "source.ip",
+              "value": Array [
+                "192.168.0.1",
+              ],
+            },
+            Object {
+              "field": "destination.ip",
+              "value": Array [
+                "192.168.0.3",
+              ],
+            },
+            Object {
+              "field": "destination.bytes",
+              "value": Array [
+                "123456",
+              ],
+            },
+            Object {
+              "field": "user.name",
+              "value": Array [
+                "john.dee",
+              ],
+            },
+          ]
+        }
         eventId="1"
-        fieldFormat=""
-        fieldName="event.action"
-        fieldType=""
-        key="plain-column-renderer-formatted-field-value-test-event.action-1-event.action-Action-0"
-        truncate={true}
-        value="Action"
+        header={
+          Object {
+            "columnHeaderType": "not-filtered",
+            "id": "event.action",
+            "width": 180,
+          }
+        }
+        linkValues={Array []}
+        renderCellValue={[Function]}
+        timelineId="test"
       />
     </styled.div>
   </styled.div>
@@ -123,15 +298,77 @@ exports[`Columns it renders the expected columns 1`] = `
           You are in a table cell. row: 2, column: 5
         </p>
       </EuiScreenReaderOnly>
-      <Memo(FormattedFieldValueComponent)
-        contextId="plain-column-renderer-formatted-field-value-test"
+      <Memo(StatefulCellComponent)
+        ariaRowindex={2}
+        data={
+          Array [
+            Object {
+              "field": "@timestamp",
+              "value": Array [
+                "2018-11-05T19:03:25.937Z",
+              ],
+            },
+            Object {
+              "field": "event.severity",
+              "value": Array [
+                "3",
+              ],
+            },
+            Object {
+              "field": "event.category",
+              "value": Array [
+                "Access",
+              ],
+            },
+            Object {
+              "field": "event.action",
+              "value": Array [
+                "Action",
+              ],
+            },
+            Object {
+              "field": "host.name",
+              "value": Array [
+                "apache",
+              ],
+            },
+            Object {
+              "field": "source.ip",
+              "value": Array [
+                "192.168.0.1",
+              ],
+            },
+            Object {
+              "field": "destination.ip",
+              "value": Array [
+                "192.168.0.3",
+              ],
+            },
+            Object {
+              "field": "destination.bytes",
+              "value": Array [
+                "123456",
+              ],
+            },
+            Object {
+              "field": "user.name",
+              "value": Array [
+                "john.dee",
+              ],
+            },
+          ]
+        }
         eventId="1"
-        fieldFormat=""
-        fieldName="host.name"
-        fieldType=""
-        key="plain-column-renderer-formatted-field-value-test-host.name-1-host.name-apache-0"
-        truncate={true}
-        value="apache"
+        header={
+          Object {
+            "columnHeaderType": "not-filtered",
+            "id": "host.name",
+            "width": 180,
+          }
+        }
+        linkValues={Array []}
+        renderCellValue={[Function]}
+        timelineId="test"
       />
     </styled.div>
   </styled.div>
@@ -153,15 +390,77 @@ exports[`Columns it renders the expected columns 1`] = `
           You are in a table cell. row: 2, column: 6
         </p>
       </EuiScreenReaderOnly>
-      <Memo(FormattedFieldValueComponent)
-        contextId="plain-column-renderer-formatted-field-value-test"
+      <Memo(StatefulCellComponent)
+        ariaRowindex={2}
+        data={
+          Array [
+            Object {
+              "field": "@timestamp",
+              "value": Array [
+                "2018-11-05T19:03:25.937Z",
+              ],
+            },
+            Object {
+              "field": "event.severity",
+              "value": Array [
+                "3",
+              ],
+            },
+            Object {
+              "field": "event.category",
+              "value": Array [
+                "Access",
+              ],
+            },
+            Object {
+              "field": "event.action",
+              "value": Array [
+                "Action",
+              ],
+            },
+            Object {
+              "field": "host.name",
+              "value": Array [
+                "apache",
+              ],
+            },
+            Object {
+              "field": "source.ip",
+              "value": Array [
+                "192.168.0.1",
+              ],
+            },
+            Object {
+              "field": "destination.ip",
+              "value": Array [
+                "192.168.0.3",
+              ],
+            },
+            Object {
+              "field": "destination.bytes",
+              "value": Array [
+                "123456",
+              ],
+            },
+            Object {
+              "field": "user.name",
+              "value": Array [
+                "john.dee",
+              ],
+            },
+          ]
+        }
         eventId="1"
-        fieldFormat=""
-        fieldName="source.ip"
-        fieldType=""
-        key="plain-column-renderer-formatted-field-value-test-source.ip-1-source.ip-192.168.0.1-0"
-        truncate={true}
-        value="192.168.0.1"
+        header={
+          Object {
+            "columnHeaderType": "not-filtered",
+            "id": "source.ip",
+            "width": 180,
+          }
+        }
+        linkValues={Array []}
+        renderCellValue={[Function]}
+        timelineId="test"
       />
     </styled.div>
   </styled.div>
@@ -183,15 +482,77 @@ exports[`Columns it renders the expected columns 1`] = `
           You are in a table cell. row: 2, column: 7
         </p>
       </EuiScreenReaderOnly>
-      <Memo(FormattedFieldValueComponent)
-        contextId="plain-column-renderer-formatted-field-value-test"
+      <Memo(StatefulCellComponent)
+        ariaRowindex={2}
+        data={
+          Array [
+            Object {
+              "field": "@timestamp",
+              "value": Array [
+                "2018-11-05T19:03:25.937Z",
+              ],
+            },
+            Object {
+              "field": "event.severity",
+              "value": Array [
+                "3",
+              ],
+            },
+            Object {
+              "field": "event.category",
+              "value": Array [
+                "Access",
+              ],
+            },
+            Object {
+              "field": "event.action",
+              "value": Array [
+                "Action",
+              ],
+            },
+            Object {
+              "field": "host.name",
+              "value": Array [
+                "apache",
+              ],
+            },
+            Object {
+              "field": "source.ip",
+              "value": Array [
+                "192.168.0.1",
+              ],
+            },
+            Object {
+              "field": "destination.ip",
+              "value": Array [
+                "192.168.0.3",
+              ],
+            },
+            Object {
+              "field": "destination.bytes",
+              "value": Array [
+                "123456",
+              ],
+            },
+            Object {
+              "field": "user.name",
+              "value": Array [
+                "john.dee",
+              ],
+            },
+          ]
+        }
         eventId="1"
-        fieldFormat=""
-        fieldName="destination.ip"
-        fieldType=""
-        key="plain-column-renderer-formatted-field-value-test-destination.ip-1-destination.ip-192.168.0.3-0"
-        truncate={true}
-        value="192.168.0.3"
+        header={
+          Object {
+            "columnHeaderType": "not-filtered",
+            "id": "destination.ip",
+            "width": 180,
+          }
+        }
+        linkValues={Array []}
+        renderCellValue={[Function]}
+        timelineId="test"
       />
     </styled.div>
   </styled.div>
@@ -213,15 +574,77 @@ exports[`Columns it renders the expected columns 1`] = `
           You are in a table cell. row: 2, column: 8
         </p>
       </EuiScreenReaderOnly>
-      <Memo(FormattedFieldValueComponent)
-        contextId="plain-column-renderer-formatted-field-value-test"
+      <Memo(StatefulCellComponent)
+        ariaRowindex={2}
+        data={
+          Array [
+            Object {
+              "field": "@timestamp",
+              "value": Array [
+                "2018-11-05T19:03:25.937Z",
+              ],
+            },
+            Object {
+              "field": "event.severity",
+              "value": Array [
+                "3",
+              ],
+            },
+            Object {
+              "field": "event.category",
+              "value": Array [
+                "Access",
+              ],
+            },
+            Object {
+              "field": "event.action",
+              "value": Array [
+                "Action",
+              ],
+            },
+            Object {
+              "field": "host.name",
+              "value": Array [
+                "apache",
+              ],
+            },
+            Object {
+              "field": "source.ip",
+              "value": Array [
+                "192.168.0.1",
+              ],
+            },
+            Object {
+              "field": "destination.ip",
+              "value": Array [
+                "192.168.0.3",
+              ],
+            },
+            Object {
+              "field": "destination.bytes",
+              "value": Array [
+                "123456",
+              ],
+            },
+            Object {
+              "field": "user.name",
+              "value": Array [
+                "john.dee",
+              ],
+            },
+          ]
+        }
         eventId="1"
-        fieldFormat=""
-        fieldName="user.name"
-        fieldType=""
-        key="plain-column-renderer-formatted-field-value-test-user.name-1-user.name-john.dee-0"
-        truncate={true}
-        value="john.dee"
+        header={
+          Object {
+            "columnHeaderType": "not-filtered",
+            "id": "user.name",
+            "width": 180,
+          }
+        }
+        linkValues={Array []}
+        renderCellValue={[Function]}
+        timelineId="test"
       />
     </styled.div>
   </styled.div>
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/data_driven_columns/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/data_driven_columns/index.test.tsx
index f20978c6ba726..234e28e6231c5 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/data_driven_columns/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/data_driven_columns/index.test.tsx
@@ -9,10 +9,10 @@ import { shallow } from 'enzyme';
 
 import React from 'react';
 
+import { DefaultCellRenderer } from '../../cell_rendering/default_cell_renderer';
 import '../../../../../common/mock/match_media';
 import { mockTimelineData } from '../../../../../common/mock';
 import { defaultHeaders } from '../column_headers/default_headers';
-import { columnRenderers } from '../renderers';
 
 import { DataDrivenColumns } from '.';
 
@@ -25,11 +25,11 @@ describe('Columns', () => {
         ariaRowindex={2}
         _id={mockTimelineData[0]._id}
         columnHeaders={headersSansTimestamp}
-        columnRenderers={columnRenderers}
         data={mockTimelineData[0].data}
         ecsData={mockTimelineData[0].ecs}
         hasRowRenderers={false}
         notesCount={0}
+        renderCellValue={DefaultCellRenderer}
         timelineId="test"
       />
     );
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/data_driven_columns/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/data_driven_columns/index.tsx
index 5aba562749f01..aeb9af46ea2ec 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/data_driven_columns/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/data_driven_columns/index.tsx
@@ -9,6 +9,7 @@ import { EuiScreenReaderOnly } from '@elastic/eui';
 import React from 'react';
 import { getOr } from 'lodash/fp';
 
+import { CellValueElementProps } from '../../cell_rendering';
 import { DRAGGABLE_KEYBOARD_WRAPPER_CLASS_NAME } from '../../../../../common/components/drag_and_drop/helpers';
 import { Ecs } from '../../../../../../common/ecs';
 import { TimelineNonEcsData } from '../../../../../../common/search_strategy/timeline';
@@ -16,20 +17,19 @@ import { TimelineTabs } from '../../../../../../common/types/timeline';
 import { ColumnHeaderOptions } from '../../../../../timelines/store/timeline/model';
 import { ARIA_COLUMN_INDEX_OFFSET } from '../../helpers';
 import { EventsTd, EVENTS_TD_CLASS_NAME, EventsTdContent, EventsTdGroupData } from '../../styles';
-import { ColumnRenderer } from '../renderers/column_renderer';
-import { getColumnRenderer } from '../renderers/get_column_renderer';
 
+import { StatefulCell } from './stateful_cell';
 import * as i18n from './translations';
 
 interface Props {
   _id: string;
   ariaRowindex: number;
   columnHeaders: ColumnHeaderOptions[];
-  columnRenderers: ColumnRenderer[];
   data: TimelineNonEcsData[];
   ecsData: Ecs;
   hasRowRenderers: boolean;
   notesCount: number;
+  renderCellValue: (props: CellValueElementProps) => React.ReactNode;
   tabType?: TimelineTabs;
   timelineId: string;
 }
@@ -82,11 +82,11 @@ export const DataDrivenColumns = React.memo<Props>(
     _id,
     ariaRowindex,
     columnHeaders,
-    columnRenderers,
     data,
     ecsData,
     hasRowRenderers,
     notesCount,
+    renderCellValue,
     tabType,
     timelineId,
   }) => (
@@ -105,18 +105,16 @@ export const DataDrivenColumns = React.memo<Props>(
               <EuiScreenReaderOnly data-test-subj="screenReaderOnly">
                 <p>{i18n.YOU_ARE_IN_A_TABLE_CELL({ row: ariaRowindex, column: i + 2 })}</p>
               </EuiScreenReaderOnly>
-              {getColumnRenderer(header.id, columnRenderers, data).renderColumn({
-                columnName: header.id,
-                eventId: _id,
-                field: header,
-                linkValues: getOr([], header.linkField ?? '', ecsData),
-                timelineId: tabType != null ? `${timelineId}-${tabType}` : timelineId,
-                truncate: true,
-                values: getMappedNonEcsValue({
-                  data,
-                  fieldName: header.id,
-                }),
-              })}
+              <StatefulCell
+                ariaRowindex={ariaRowindex}
+                data={data}
+                header={header}
+                eventId={_id}
+                linkValues={getOr([], header.linkField ?? '', ecsData)}
+                renderCellValue={renderCellValue}
+                tabType={tabType}
+                timelineId={timelineId}
+              />
             </>
           </EventsTdContent>
           {hasRowRenderers ? (
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/data_driven_columns/stateful_cell.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/data_driven_columns/stateful_cell.test.tsx
new file mode 100644
index 0000000000000..3c75bc7fb2649
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/data_driven_columns/stateful_cell.test.tsx
@@ -0,0 +1,171 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { mount } from 'enzyme';
+import { cloneDeep } from 'lodash/fp';
+import React, { useEffect } from 'react';
+
+import { CellValueElementProps } from '../../cell_rendering';
+import { defaultHeaders, mockTimelineData } from '../../../../../common/mock';
+import { TimelineNonEcsData } from '../../../../../../common/search_strategy/timeline';
+import { TimelineTabs } from '../../../../../../common/types/timeline';
+import { ColumnHeaderOptions } from '../../../../store/timeline/model';
+
+import { StatefulCell } from './stateful_cell';
+import { getMappedNonEcsValue } from '.';
+
+/**
+ * This (test) component implement's `EuiDataGrid`'s `renderCellValue` interface,
+ * as documented here: https://elastic.github.io/eui/#/tabular-content/data-grid
+ *
+ * Its `CellValueElementProps` props are a superset of `EuiDataGridCellValueElementProps`.
+ * The `setCellProps` function, defined by the `EuiDataGridCellValueElementProps` interface,
+ * is typically called in a `useEffect`, as illustrated by `EuiDataGrid`'s code sandbox example:
+ * https://codesandbox.io/s/zhxmo
+ */
+const RenderCellValue: React.FC<CellValueElementProps> = ({ columnId, data, setCellProps }) => {
+  useEffect(() => {
+    // branching logic that conditionally renders a specific cell green:
+    if (columnId === defaultHeaders[0].id) {
+      const value = getMappedNonEcsValue({
+        data,
+        fieldName: columnId,
+      });
+
+      if (value?.length) {
+        setCellProps({
+          style: {
+            backgroundColor: 'green',
+          },
+        });
+      }
+    }
+  }, [columnId, data, setCellProps]);
+
+  return (
+    <div data-test-subj="renderCellValue">
+      {getMappedNonEcsValue({
+        data,
+        fieldName: columnId,
+      })}
+    </div>
+  );
+};
+
+describe('StatefulCell', () => {
+  const ariaRowindex = 123;
+  const eventId = '_id-123';
+  const linkValues = ['foo', 'bar', '@baz'];
+  const tabType = TimelineTabs.query;
+  const timelineId = 'test';
+
+  let header: ColumnHeaderOptions;
+  let data: TimelineNonEcsData[];
+  beforeEach(() => {
+    data = cloneDeep(mockTimelineData[0].data);
+    header = cloneDeep(defaultHeaders[0]);
+  });
+
+  test('it invokes renderCellValue with the expected arguments when tabType is specified', () => {
+    const renderCellValue = jest.fn();
+
+    mount(
+      <StatefulCell
+        ariaRowindex={ariaRowindex}
+        data={data}
+        header={header}
+        eventId={eventId}
+        linkValues={linkValues}
+        renderCellValue={renderCellValue}
+        tabType={TimelineTabs.query}
+        timelineId={timelineId}
+      />
+    );
+
+    expect(renderCellValue).toBeCalledWith(
+      expect.objectContaining({
+        columnId: header.id,
+        eventId,
+        data,
+        header,
+        isExpandable: true,
+        isExpanded: false,
+        isDetails: false,
+        linkValues,
+        rowIndex: ariaRowindex - 1,
+        timelineId: `${timelineId}-${tabType}`,
+      })
+    );
+  });
+
+  test('it invokes renderCellValue with the expected arguments when tabType is NOT specified', () => {
+    const renderCellValue = jest.fn();
+
+    mount(
+      <StatefulCell
+        ariaRowindex={ariaRowindex}
+        data={data}
+        header={header}
+        eventId={eventId}
+        linkValues={linkValues}
+        renderCellValue={renderCellValue}
+        timelineId={timelineId}
+      />
+    );
+
+    expect(renderCellValue).toBeCalledWith(
+      expect.objectContaining({
+        columnId: header.id,
+        eventId,
+        data,
+        header,
+        isExpandable: true,
+        isExpanded: false,
+        isDetails: false,
+        linkValues,
+        rowIndex: ariaRowindex - 1,
+        timelineId,
+      })
+    );
+  });
+
+  test('it renders the React.Node returned by renderCellValue', () => {
+    const renderCellValue = () => <div data-test-subj="renderCellValue" />;
+
+    const wrapper = mount(
+      <StatefulCell
+        ariaRowindex={ariaRowindex}
+        data={data}
+        header={header}
+        eventId={eventId}
+        linkValues={linkValues}
+        renderCellValue={renderCellValue}
+        timelineId={timelineId}
+      />
+    );
+
+    expect(wrapper.find('[data-test-subj="renderCellValue"]').exists()).toBe(true);
+  });
+
+  test("it renders a div with the styles set by `renderCellValue`'s `setCellProps` argument", () => {
+    const wrapper = mount(
+      <StatefulCell
+        ariaRowindex={ariaRowindex}
+        data={data}
+        header={header}
+        eventId={eventId}
+        linkValues={linkValues}
+        renderCellValue={RenderCellValue}
+        timelineId={timelineId}
+      />
+    );
+
+    expect(
+      wrapper.find('[data-test-subj="statefulCell"]').getDOMNode().getAttribute('style')
+    ).toEqual('background-color: green;');
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/data_driven_columns/stateful_cell.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/data_driven_columns/stateful_cell.tsx
new file mode 100644
index 0000000000000..83f603364ba8c
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/data_driven_columns/stateful_cell.tsx
@@ -0,0 +1,63 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { HTMLAttributes, useState } from 'react';
+
+import { CellValueElementProps } from '../../cell_rendering';
+import { TimelineNonEcsData } from '../../../../../../common/search_strategy/timeline';
+import { TimelineTabs } from '../../../../../../common/types/timeline';
+import { ColumnHeaderOptions } from '../../../../../timelines/store/timeline/model';
+
+export interface CommonProps {
+  className?: string;
+  'aria-label'?: string;
+  'data-test-subj'?: string;
+}
+
+const StatefulCellComponent = ({
+  ariaRowindex,
+  data,
+  header,
+  eventId,
+  linkValues,
+  renderCellValue,
+  tabType,
+  timelineId,
+}: {
+  ariaRowindex: number;
+  data: TimelineNonEcsData[];
+  header: ColumnHeaderOptions;
+  eventId: string;
+  linkValues: string[] | undefined;
+  renderCellValue: (props: CellValueElementProps) => React.ReactNode;
+  tabType?: TimelineTabs;
+  timelineId: string;
+}) => {
+  const [cellProps, setCellProps] = useState<CommonProps & HTMLAttributes<HTMLDivElement>>({});
+
+  return (
+    <div data-test-subj="statefulCell" {...cellProps}>
+      {renderCellValue({
+        columnId: header.id,
+        eventId,
+        data,
+        header,
+        isExpandable: true,
+        isExpanded: false,
+        isDetails: false,
+        linkValues,
+        rowIndex: ariaRowindex - 1,
+        setCellProps,
+        timelineId: tabType != null ? `${timelineId}-${tabType}` : timelineId,
+      })}
+    </div>
+  );
+};
+
+StatefulCellComponent.displayName = 'StatefulCellComponent';
+
+export const StatefulCell = React.memo(StatefulCellComponent);
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/event_column_view.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/event_column_view.test.tsx
index abdfda3272d6a..74724dedf4d11 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/event_column_view.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/event_column_view.test.tsx
@@ -14,6 +14,7 @@ import { DEFAULT_ACTIONS_COLUMN_WIDTH } from '../constants';
 import * as i18n from '../translations';
 
 import { EventColumnView } from './event_column_view';
+import { DefaultCellRenderer } from '../../cell_rendering/default_cell_renderer';
 import { TimelineTabs, TimelineType, TimelineId } from '../../../../../../common/types/timeline';
 import { useShallowEqualSelector } from '../../../../../common/hooks/use_selector';
 
@@ -56,6 +57,7 @@ describe('EventColumnView', () => {
     onRowSelected: jest.fn(),
     onUnPinEvent: jest.fn(),
     refetch: jest.fn(),
+    renderCellValue: DefaultCellRenderer,
     selectedEventIds: {},
     showCheckboxes: false,
     showNotes: false,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/event_column_view.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/event_column_view.tsx
index c6caf0a7b5b15..a0a0aeb23e8f7 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/event_column_view.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/event_column_view.tsx
@@ -7,6 +7,7 @@
 
 import React, { useCallback, useMemo } from 'react';
 
+import { CellValueElementProps } from '../../cell_rendering';
 import { useShallowEqualSelector } from '../../../../../common/hooks/use_selector';
 import { Ecs } from '../../../../../../common/ecs';
 import { TimelineNonEcsData } from '../../../../../../common/search_strategy/timeline';
@@ -21,7 +22,6 @@ import {
   getPinOnClick,
   InvestigateInResolverAction,
 } from '../helpers';
-import { ColumnRenderer } from '../renderers/column_renderer';
 import { AlertContextMenu } from '../../../../../detections/components/alerts_table/timeline_actions/alert_context_menu';
 import { InvestigateInTimelineAction } from '../../../../../detections/components/alerts_table/timeline_actions/investigate_in_timeline_action';
 import { AddEventNoteAction } from '../actions/add_note_icon_item';
@@ -38,7 +38,6 @@ interface Props {
   actionsColumnWidth: number;
   ariaRowindex: number;
   columnHeaders: ColumnHeaderOptions[];
-  columnRenderers: ColumnRenderer[];
   data: TimelineNonEcsData[];
   ecsData: Ecs;
   eventIdToNoteIds: Readonly<Record<string, string[]>>;
@@ -51,6 +50,7 @@ interface Props {
   onRowSelected: OnRowSelected;
   onUnPinEvent: OnUnPinEvent;
   refetch: inputsModel.Refetch;
+  renderCellValue: (props: CellValueElementProps) => React.ReactNode;
   onRuleChange?: () => void;
   hasRowRenderers: boolean;
   selectedEventIds: Readonly<Record<string, TimelineNonEcsData[]>>;
@@ -69,7 +69,6 @@ export const EventColumnView = React.memo<Props>(
     actionsColumnWidth,
     ariaRowindex,
     columnHeaders,
-    columnRenderers,
     data,
     ecsData,
     eventIdToNoteIds,
@@ -84,6 +83,7 @@ export const EventColumnView = React.memo<Props>(
     refetch,
     hasRowRenderers,
     onRuleChange,
+    renderCellValue,
     selectedEventIds,
     showCheckboxes,
     showNotes,
@@ -227,11 +227,11 @@ export const EventColumnView = React.memo<Props>(
           _id={id}
           ariaRowindex={ariaRowindex}
           columnHeaders={columnHeaders}
-          columnRenderers={columnRenderers}
           data={data}
           ecsData={ecsData}
           hasRowRenderers={hasRowRenderers}
           notesCount={notesCount}
+          renderCellValue={renderCellValue}
           tabType={tabType}
           timelineId={timelineId}
         />
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/index.tsx
index d76b5834c233e..7f8a3a92fb5ba 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/index.tsx
@@ -8,6 +8,7 @@
 import React from 'react';
 import { isEmpty } from 'lodash';
 
+import { CellValueElementProps } from '../../cell_rendering';
 import { inputsModel } from '../../../../../common/store';
 import { BrowserFields } from '../../../../../common/containers/source';
 import {
@@ -18,7 +19,6 @@ import { TimelineTabs } from '../../../../../../common/types/timeline';
 import { ColumnHeaderOptions } from '../../../../../timelines/store/timeline/model';
 import { OnRowSelected } from '../../events';
 import { EventsTbody } from '../../styles';
-import { ColumnRenderer } from '../renderers/column_renderer';
 import { RowRenderer } from '../renderers/row_renderer';
 import { StatefulEvent } from './stateful_event';
 import { eventIsPinned } from '../helpers';
@@ -30,7 +30,6 @@ interface Props {
   actionsColumnWidth: number;
   browserFields: BrowserFields;
   columnHeaders: ColumnHeaderOptions[];
-  columnRenderers: ColumnRenderer[];
   containerRef: React.MutableRefObject<HTMLDivElement | null>;
   data: TimelineItem[];
   eventIdToNoteIds: Readonly<Record<string, string[]>>;
@@ -41,6 +40,7 @@ interface Props {
   onRowSelected: OnRowSelected;
   pinnedEventIds: Readonly<Record<string, boolean>>;
   refetch: inputsModel.Refetch;
+  renderCellValue: (props: CellValueElementProps) => React.ReactNode;
   onRuleChange?: () => void;
   rowRenderers: RowRenderer[];
   selectedEventIds: Readonly<Record<string, TimelineNonEcsData[]>>;
@@ -52,7 +52,6 @@ const EventsComponent: React.FC<Props> = ({
   actionsColumnWidth,
   browserFields,
   columnHeaders,
-  columnRenderers,
   containerRef,
   data,
   eventIdToNoteIds,
@@ -64,6 +63,7 @@ const EventsComponent: React.FC<Props> = ({
   pinnedEventIds,
   refetch,
   onRuleChange,
+  renderCellValue,
   rowRenderers,
   selectedEventIds,
   showCheckboxes,
@@ -76,7 +76,6 @@ const EventsComponent: React.FC<Props> = ({
         ariaRowindex={i + ARIA_ROW_INDEX_OFFSET}
         browserFields={browserFields}
         columnHeaders={columnHeaders}
-        columnRenderers={columnRenderers}
         containerRef={containerRef}
         event={event}
         eventIdToNoteIds={eventIdToNoteIds}
@@ -88,6 +87,7 @@ const EventsComponent: React.FC<Props> = ({
         lastFocusedAriaColindex={lastFocusedAriaColindex}
         loadingEventIds={loadingEventIds}
         onRowSelected={onRowSelected}
+        renderCellValue={renderCellValue}
         refetch={refetch}
         rowRenderers={rowRenderers}
         onRuleChange={onRuleChange}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/stateful_event.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/stateful_event.tsx
index 4191badd6b03f..97ab088b61583 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/stateful_event.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/stateful_event.tsx
@@ -8,6 +8,7 @@
 import React, { useCallback, useMemo, useRef, useState } from 'react';
 import { useDispatch } from 'react-redux';
 
+import { CellValueElementProps } from '../../cell_rendering';
 import { useDeepEqualSelector } from '../../../../../common/hooks/use_selector';
 import {
   TimelineExpandedDetailType,
@@ -23,7 +24,6 @@ import { ColumnHeaderOptions } from '../../../../../timelines/store/timeline/mod
 import { OnPinEvent, OnRowSelected } from '../../events';
 import { STATEFUL_EVENT_CSS_CLASS_NAME } from '../../helpers';
 import { EventsTrGroup, EventsTrSupplement, EventsTrSupplementContainer } from '../../styles';
-import { ColumnRenderer } from '../renderers/column_renderer';
 import { RowRenderer } from '../renderers/row_renderer';
 import { isEventBuildingBlockType, getEventType, isEvenEqlSequence } from '../helpers';
 import { NoteCards } from '../../../notes/note_cards';
@@ -45,7 +45,6 @@ interface Props {
   containerRef: React.MutableRefObject<HTMLDivElement | null>;
   browserFields: BrowserFields;
   columnHeaders: ColumnHeaderOptions[];
-  columnRenderers: ColumnRenderer[];
   event: TimelineItem;
   eventIdToNoteIds: Readonly<Record<string, string[]>>;
   isEventViewer?: boolean;
@@ -56,6 +55,7 @@ interface Props {
   refetch: inputsModel.Refetch;
   ariaRowindex: number;
   onRuleChange?: () => void;
+  renderCellValue: (props: CellValueElementProps) => React.ReactNode;
   rowRenderers: RowRenderer[];
   selectedEventIds: Readonly<Record<string, TimelineNonEcsData[]>>;
   showCheckboxes: boolean;
@@ -77,7 +77,6 @@ const StatefulEventComponent: React.FC<Props> = ({
   browserFields,
   containerRef,
   columnHeaders,
-  columnRenderers,
   event,
   eventIdToNoteIds,
   isEventViewer = false,
@@ -86,8 +85,9 @@ const StatefulEventComponent: React.FC<Props> = ({
   loadingEventIds,
   onRowSelected,
   refetch,
-  onRuleChange,
+  renderCellValue,
   rowRenderers,
+  onRuleChange,
   ariaRowindex,
   selectedEventIds,
   showCheckboxes,
@@ -259,7 +259,6 @@ const StatefulEventComponent: React.FC<Props> = ({
           actionsColumnWidth={actionsColumnWidth}
           ariaRowindex={ariaRowindex}
           columnHeaders={columnHeaders}
-          columnRenderers={columnRenderers}
           data={event.data}
           ecsData={event.ecs}
           eventIdToNoteIds={eventIdToNoteIds}
@@ -273,6 +272,7 @@ const StatefulEventComponent: React.FC<Props> = ({
           onRowSelected={onRowSelected}
           onUnPinEvent={onUnPinEvent}
           refetch={refetch}
+          renderCellValue={renderCellValue}
           onRuleChange={onRuleChange}
           selectedEventIds={selectedEventIds}
           showCheckboxes={showCheckboxes}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.test.tsx
index 723e4c3de5c27..76dbfc553d228 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.test.tsx
@@ -8,6 +8,7 @@
 import React from 'react';
 import { waitFor } from '@testing-library/react';
 
+import { DefaultCellRenderer } from '../cell_rendering/default_cell_renderer';
 import '../../../../common/mock/match_media';
 import { mockBrowserFields } from '../../../../common/containers/source/mock';
 import { Direction } from '../../../../../common/search_strategy';
@@ -19,6 +20,7 @@ import { Sort } from './sort';
 import { useMountAppended } from '../../../../common/utils/use_mount_appended';
 import { timelineActions } from '../../../store/timeline';
 import { TimelineTabs } from '../../../../../common/types/timeline';
+import { defaultRowRenderers } from './renderers';
 
 const mockSort: Sort[] = [
   {
@@ -39,8 +41,8 @@ jest.mock('react-redux', () => {
 });
 
 jest.mock('../../../../common/hooks/use_selector', () => ({
-  useShallowEqualSelector: jest.fn().mockReturnValue(mockTimelineModel),
-  useDeepEqualSelector: jest.fn().mockReturnValue(mockTimelineModel),
+  useShallowEqualSelector: () => mockTimelineModel,
+  useDeepEqualSelector: () => mockTimelineModel,
 }));
 
 jest.mock('../../../../common/components/link_to');
@@ -76,6 +78,8 @@ describe('Body', () => {
     loadingEventIds: [],
     pinnedEventIds: {},
     refetch: jest.fn(),
+    renderCellValue: DefaultCellRenderer,
+    rowRenderers: defaultRowRenderers,
     selectedEventIds: {},
     setSelected: (jest.fn() as unknown) as StatefulBodyProps['setSelected'],
     sort: mockSort,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.tsx
index 4df6eb16ccb62..59c0610c544e9 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.tsx
@@ -11,6 +11,7 @@ import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react'
 import { connect, ConnectedProps } from 'react-redux';
 import deepEqual from 'fast-deep-equal';
 
+import { CellValueElementProps } from '../cell_rendering';
 import { RowRendererId, TimelineId, TimelineTabs } from '../../../../../common/types/timeline';
 import {
   FIRST_ARIA_INDEX,
@@ -28,9 +29,9 @@ import { timelineActions, timelineSelectors } from '../../../store/timeline';
 import { OnRowSelected, OnSelectAll } from '../events';
 import { getActionsColumnWidth, getColumnHeaders } from './column_headers/helpers';
 import { getEventIdToDataMapping } from './helpers';
-import { columnRenderers, rowRenderers } from './renderers';
 import { Sort } from './sort';
 import { plainRowRenderer } from './renderers/plain_row_renderer';
+import { RowRenderer } from './renderers/row_renderer';
 import { EventsTable, TimelineBody, TimelineBodyGlobalStyle } from '../styles';
 import { ColumnHeaders } from './column_headers';
 import { Events } from './events';
@@ -44,6 +45,8 @@ interface OwnProps {
   isEventViewer?: boolean;
   sort: Sort[];
   refetch: inputsModel.Refetch;
+  renderCellValue: (props: CellValueElementProps) => React.ReactNode;
+  rowRenderers: RowRenderer[];
   tabType: TimelineTabs;
   totalPages: number;
   onRuleChange?: () => void;
@@ -83,6 +86,8 @@ export const BodyComponent = React.memo<StatefulBodyProps>(
     onRuleChange,
     showCheckboxes,
     refetch,
+    renderCellValue,
+    rowRenderers,
     sort,
     tabType,
     totalPages,
@@ -141,7 +146,7 @@ export const BodyComponent = React.memo<StatefulBodyProps>(
       if (!excludedRowRendererIds) return rowRenderers;
 
       return rowRenderers.filter((rowRenderer) => !excludedRowRendererIds.includes(rowRenderer.id));
-    }, [excludedRowRendererIds]);
+    }, [excludedRowRendererIds, rowRenderers]);
 
     const actionsColumnWidth = useMemo(
       () =>
@@ -209,7 +214,6 @@ export const BodyComponent = React.memo<StatefulBodyProps>(
               actionsColumnWidth={actionsColumnWidth}
               browserFields={browserFields}
               columnHeaders={columnHeaders}
-              columnRenderers={columnRenderers}
               data={data}
               eventIdToNoteIds={eventIdToNoteIds}
               id={id}
@@ -219,6 +223,7 @@ export const BodyComponent = React.memo<StatefulBodyProps>(
               onRowSelected={onRowSelected}
               pinnedEventIds={pinnedEventIds}
               refetch={refetch}
+              renderCellValue={renderCellValue}
               rowRenderers={enabledRowRenderers}
               onRuleChange={onRuleChange}
               selectedEventIds={selectedEventIds}
@@ -244,6 +249,8 @@ export const BodyComponent = React.memo<StatefulBodyProps>(
     prevProps.id === nextProps.id &&
     prevProps.isEventViewer === nextProps.isEventViewer &&
     prevProps.isSelectAllChecked === nextProps.isSelectAllChecked &&
+    prevProps.renderCellValue === nextProps.renderCellValue &&
+    prevProps.rowRenderers === nextProps.rowRenderers &&
     prevProps.showCheckboxes === nextProps.showCheckboxes &&
     prevProps.tabType === nextProps.tabType
 );
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/get_row_renderer.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/get_row_renderer.test.tsx
index 6e36102da2de9..b92a4381d837b 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/get_row_renderer.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/get_row_renderer.test.tsx
@@ -17,7 +17,7 @@ import { mockTimelineData } from '../../../../../common/mock';
 import { TestProviders } from '../../../../../common/mock/test_providers';
 import { useMountAppended } from '../../../../../common/utils/use_mount_appended';
 
-import { rowRenderers } from '.';
+import { defaultRowRenderers } from '.';
 import { getRowRenderer } from './get_row_renderer';
 
 jest.mock('@elastic/eui', () => {
@@ -48,7 +48,7 @@ describe('get_column_renderer', () => {
   });
 
   test('renders correctly against snapshot', () => {
-    const rowRenderer = getRowRenderer(nonSuricata, rowRenderers);
+    const rowRenderer = getRowRenderer(nonSuricata, defaultRowRenderers);
     const row = rowRenderer?.renderRow({
       browserFields: mockBrowserFields,
       data: nonSuricata,
@@ -60,7 +60,7 @@ describe('get_column_renderer', () => {
   });
 
   test('should render plain row data when it is a non suricata row', () => {
-    const rowRenderer = getRowRenderer(nonSuricata, rowRenderers);
+    const rowRenderer = getRowRenderer(nonSuricata, defaultRowRenderers);
     const row = rowRenderer?.renderRow({
       browserFields: mockBrowserFields,
       data: nonSuricata,
@@ -75,7 +75,7 @@ describe('get_column_renderer', () => {
   });
 
   test('should render a suricata row data when it is a suricata row', () => {
-    const rowRenderer = getRowRenderer(suricata, rowRenderers);
+    const rowRenderer = getRowRenderer(suricata, defaultRowRenderers);
     const row = rowRenderer?.renderRow({
       browserFields: mockBrowserFields,
       data: suricata,
@@ -93,7 +93,7 @@ describe('get_column_renderer', () => {
 
   test('should render a suricata row data if event.category is network_traffic', () => {
     suricata.event = { ...suricata.event, ...{ category: ['network_traffic'] } };
-    const rowRenderer = getRowRenderer(suricata, rowRenderers);
+    const rowRenderer = getRowRenderer(suricata, defaultRowRenderers);
     const row = rowRenderer?.renderRow({
       browserFields: mockBrowserFields,
       data: suricata,
@@ -111,7 +111,7 @@ describe('get_column_renderer', () => {
 
   test('should render a zeek row data if event.category is network_traffic', () => {
     zeek.event = { ...zeek.event, ...{ category: ['network_traffic'] } };
-    const rowRenderer = getRowRenderer(zeek, rowRenderers);
+    const rowRenderer = getRowRenderer(zeek, defaultRowRenderers);
     const row = rowRenderer?.renderRow({
       browserFields: mockBrowserFields,
       data: zeek,
@@ -129,7 +129,7 @@ describe('get_column_renderer', () => {
 
   test('should render a system row data if event.category is network_traffic', () => {
     system.event = { ...system.event, ...{ category: ['network_traffic'] } };
-    const rowRenderer = getRowRenderer(system, rowRenderers);
+    const rowRenderer = getRowRenderer(system, defaultRowRenderers);
     const row = rowRenderer?.renderRow({
       browserFields: mockBrowserFields,
       data: system,
@@ -147,7 +147,7 @@ describe('get_column_renderer', () => {
 
   test('should render a auditd row data if event.category is network_traffic', () => {
     auditd.event = { ...auditd.event, ...{ category: ['network_traffic'] } };
-    const rowRenderer = getRowRenderer(auditd, rowRenderers);
+    const rowRenderer = getRowRenderer(auditd, defaultRowRenderers);
     const row = rowRenderer?.renderRow({
       browserFields: mockBrowserFields,
       data: auditd,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/index.ts b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/index.ts
index 671d183c62e6d..209a9414f62f1 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/index.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/index.ts
@@ -23,7 +23,7 @@ import { systemRowRenderers } from './system/generic_row_renderer';
 // Suricata and Zeek which is why Suricata and Zeek are above it. The
 // plainRowRenderer always returns true to everything which is why it always
 // should be last.
-export const rowRenderers: RowRenderer[] = [
+export const defaultRowRenderers: RowRenderer[] = [
   ...auditdRowRenderers,
   ...systemRowRenderers,
   suricataRowRenderer,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/default_cell_renderer.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/default_cell_renderer.test.tsx
new file mode 100644
index 0000000000000..5ac1dcf8805cf
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/default_cell_renderer.test.tsx
@@ -0,0 +1,107 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { mount } from 'enzyme';
+import { cloneDeep } from 'lodash/fp';
+import React from 'react';
+
+import { columnRenderers } from '../body/renderers';
+import { getColumnRenderer } from '../body/renderers/get_column_renderer';
+import { DragDropContextWrapper } from '../../../../common/components/drag_and_drop/drag_drop_context_wrapper';
+import { DroppableWrapper } from '../../../../common/components/drag_and_drop/droppable_wrapper';
+import { mockBrowserFields } from '../../../../common/containers/source/mock';
+import { defaultHeaders, mockTimelineData, TestProviders } from '../../../../common/mock';
+import { DefaultCellRenderer } from './default_cell_renderer';
+
+jest.mock('../body/renderers/get_column_renderer');
+const getColumnRendererMock = getColumnRenderer as jest.Mock;
+const mockImplementation = {
+  renderColumn: jest.fn(),
+};
+
+describe('DefaultCellRenderer', () => {
+  const columnId = 'signal.rule.risk_score';
+  const eventId = '_id-123';
+  const isDetails = true;
+  const isExpandable = true;
+  const isExpanded = true;
+  const linkValues = ['foo', 'bar', '@baz'];
+  const rowIndex = 3;
+  const setCellProps = jest.fn();
+  const timelineId = 'test';
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    getColumnRendererMock.mockImplementation(() => mockImplementation);
+  });
+
+  test('it invokes `getColumnRenderer` with the expected arguments', () => {
+    const data = cloneDeep(mockTimelineData[0].data);
+    const header = cloneDeep(defaultHeaders[0]);
+
+    mount(
+      <TestProviders>
+        <DragDropContextWrapper browserFields={mockBrowserFields}>
+          <DroppableWrapper droppableId="testing">
+            <DefaultCellRenderer
+              columnId={columnId}
+              data={data}
+              eventId={eventId}
+              header={header}
+              isDetails={isDetails}
+              isExpandable={isExpandable}
+              isExpanded={isExpanded}
+              linkValues={linkValues}
+              rowIndex={rowIndex}
+              setCellProps={setCellProps}
+              timelineId={timelineId}
+            />
+          </DroppableWrapper>
+        </DragDropContextWrapper>
+      </TestProviders>
+    );
+
+    expect(getColumnRenderer).toBeCalledWith(header.id, columnRenderers, data);
+  });
+
+  test('it invokes `renderColumn` with the expected arguments', () => {
+    const data = cloneDeep(mockTimelineData[0].data);
+    const header = cloneDeep(defaultHeaders[0]);
+
+    mount(
+      <TestProviders>
+        <DragDropContextWrapper browserFields={mockBrowserFields}>
+          <DroppableWrapper droppableId="testing">
+            <DefaultCellRenderer
+              columnId={columnId}
+              data={data}
+              eventId={eventId}
+              header={header}
+              isDetails={isDetails}
+              isExpandable={isExpandable}
+              isExpanded={isExpanded}
+              linkValues={linkValues}
+              rowIndex={rowIndex}
+              setCellProps={setCellProps}
+              timelineId={timelineId}
+            />
+          </DroppableWrapper>
+        </DragDropContextWrapper>
+      </TestProviders>
+    );
+
+    expect(mockImplementation.renderColumn).toBeCalledWith({
+      columnName: header.id,
+      eventId,
+      field: header,
+      linkValues,
+      timelineId,
+      truncate: true,
+      values: ['2018-11-05T19:03:25.937Z'],
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/default_cell_renderer.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/default_cell_renderer.tsx
new file mode 100644
index 0000000000000..8d8f821107e7b
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/default_cell_renderer.tsx
@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+
+import { getMappedNonEcsValue } from '../body/data_driven_columns';
+import { columnRenderers } from '../body/renderers';
+import { getColumnRenderer } from '../body/renderers/get_column_renderer';
+
+import { CellValueElementProps } from '.';
+
+export const DefaultCellRenderer: React.FC<CellValueElementProps> = ({
+  columnId,
+  data,
+  eventId,
+  header,
+  linkValues,
+  setCellProps,
+  timelineId,
+}) => (
+  <>
+    {getColumnRenderer(header.id, columnRenderers, data).renderColumn({
+      columnName: header.id,
+      eventId,
+      field: header,
+      linkValues,
+      timelineId,
+      truncate: true,
+      values: getMappedNonEcsValue({
+        data,
+        fieldName: header.id,
+      }),
+    })}
+  </>
+);
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/index.tsx
new file mode 100644
index 0000000000000..03e444e3a9afd
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/index.tsx
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiDataGridCellValueElementProps } from '@elastic/eui';
+
+import { TimelineNonEcsData } from '../../../../../common/search_strategy/timeline';
+import { ColumnHeaderOptions } from '../../../store/timeline/model';
+
+/** The following props are provided to the function called by `renderCellValue` */
+export type CellValueElementProps = EuiDataGridCellValueElementProps & {
+  data: TimelineNonEcsData[];
+  eventId: string; // _id
+  header: ColumnHeaderOptions;
+  linkValues: string[] | undefined;
+  timelineId: string;
+};
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/eql_tab_content/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/timeline/eql_tab_content/__snapshots__/index.test.tsx.snap
index 2595f29144b80..7d237ecaf92df 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/eql_tab_content/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/eql_tab_content/__snapshots__/index.test.tsx.snap
@@ -140,6 +140,986 @@ In other use cases the message field can be used to concatenate different values
     ]
   }
   onEventClosed={[MockFunction]}
+  renderCellValue={[Function]}
+  rowRenderers={
+    Array [
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_dns",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_security_event",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_security_event",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_fim",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_fim",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_fim",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_fim",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_fim",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_fim",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "alerts",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "alerts",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "alerts",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "alerts",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "alerts",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "alerts",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "alerts",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "alerts",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "alerts",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "alerts",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "library",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_fim",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "registry",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_socket",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_socket",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_socket",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_socket",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_socket",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_socket",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_socket",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_security_event",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_security_event",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_security_event",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_fim",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_fim",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_security_event",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_socket",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_socket",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "suricata",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "zeek",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "netflow",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+    ]
+  }
   showExpandedDetails={false}
   start="2018-03-23T18:49:23.132Z"
   timelineId="test"
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/eql_tab_content/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/eql_tab_content/index.test.tsx
index 7b77a915f2f05..e13bed1e2eff6 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/eql_tab_content/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/eql_tab_content/index.test.tsx
@@ -9,6 +9,8 @@ import { shallow } from 'enzyme';
 import React from 'react';
 import useResizeObserver from 'use-resize-observer/polyfilled';
 
+import { defaultRowRenderers } from '../body/renderers';
+import { DefaultCellRenderer } from '../cell_rendering/default_cell_renderer';
 import { defaultHeaders, mockTimelineData } from '../../../../common/mock';
 import '../../../../common/mock/match_media';
 import { TestProviders } from '../../../../common/mock/test_providers';
@@ -94,6 +96,8 @@ describe('Timeline', () => {
       itemsPerPage: 5,
       itemsPerPageOptions: [5, 10, 20],
       onEventClosed: jest.fn(),
+      renderCellValue: DefaultCellRenderer,
+      rowRenderers: defaultRowRenderers,
       showExpandedDetails: false,
       start: startDate,
       timerangeKind: 'absolute',
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/eql_tab_content/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/eql_tab_content/index.tsx
index 51f8db4e796e5..6bb19ce5a6852 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/eql_tab_content/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/eql_tab_content/index.tsx
@@ -22,10 +22,12 @@ import deepEqual from 'fast-deep-equal';
 import { InPortal } from 'react-reverse-portal';
 
 import { timelineActions, timelineSelectors } from '../../../store/timeline';
+import { CellValueElementProps } from '../cell_rendering';
 import { TimelineItem } from '../../../../../common/search_strategy';
 import { useTimelineEvents } from '../../../containers/index';
 import { defaultHeaders } from '../body/column_headers/default_headers';
 import { StatefulBody } from '../body';
+import { RowRenderer } from '../body/renderers/row_renderer';
 import { Footer, footerHeight } from '../footer';
 import { calculateTotalPages } from '../helpers';
 import { TimelineRefetch } from '../refetch_timeline';
@@ -133,6 +135,8 @@ const isTimerangeSame = (prevProps: Props, nextProps: Props) =>
   prevProps.timerangeKind === nextProps.timerangeKind;
 
 interface OwnProps {
+  renderCellValue: (props: CellValueElementProps) => React.ReactNode;
+  rowRenderers: RowRenderer[];
   timelineId: string;
 }
 
@@ -154,6 +158,8 @@ export const EqlTabContentComponent: React.FC<Props> = ({
   itemsPerPage,
   itemsPerPageOptions,
   onEventClosed,
+  renderCellValue,
+  rowRenderers,
   showExpandedDetails,
   start,
   timerangeKind,
@@ -284,6 +290,8 @@ export const EqlTabContentComponent: React.FC<Props> = ({
                 data={isBlankTimeline ? EMPTY_EVENTS : events}
                 id={timelineId}
                 refetch={refetch}
+                renderCellValue={renderCellValue}
+                rowRenderers={rowRenderers}
                 sort={NO_SORTING}
                 tabType={TimelineTabs.eql}
                 totalPages={calculateTotalPages({
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/index.test.tsx
index ee2ce8cf8103b..db7a3cc3c9900 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/index.test.tsx
@@ -17,7 +17,9 @@ import { mockIndexNames, mockIndexPattern, TestProviders } from '../../../common
 
 import { StatefulTimeline, Props as StatefulTimelineOwnProps } from './index';
 import { useTimelineEvents } from '../../containers/index';
+import { DefaultCellRenderer } from './cell_rendering/default_cell_renderer';
 import { SELECTOR_TIMELINE_GLOBAL_CONTAINER } from './styles';
+import { defaultRowRenderers } from './body/renderers';
 
 jest.mock('../../containers/index', () => ({
   useTimelineEvents: jest.fn(),
@@ -63,6 +65,8 @@ jest.mock('../../../common/containers/sourcerer', () => {
 });
 describe('StatefulTimeline', () => {
   const props: StatefulTimelineOwnProps = {
+    renderCellValue: DefaultCellRenderer,
+    rowRenderers: defaultRowRenderers,
     timelineId: TimelineId.test,
   };
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/index.tsx
index 6d2374dd8eef7..367357511c9c8 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/index.tsx
@@ -14,6 +14,8 @@ import styled from 'styled-components';
 import { timelineActions, timelineSelectors } from '../../store/timeline';
 import { timelineDefaults } from '../../../timelines/store/timeline/defaults';
 import { defaultHeaders } from './body/column_headers/default_headers';
+import { RowRenderer } from './body/renderers/row_renderer';
+import { CellValueElementProps } from './cell_rendering';
 import { isTab } from '../../../common/components/accessibility/helpers';
 import { useSourcererScope } from '../../../common/containers/sourcerer';
 import { SourcererScopeName } from '../../../common/store/sourcerer/model';
@@ -36,10 +38,12 @@ const TimelineTemplateBadge = styled.div`
 `;
 
 export interface Props {
+  renderCellValue: (props: CellValueElementProps) => React.ReactNode;
+  rowRenderers: RowRenderer[];
   timelineId: TimelineId;
 }
 
-const TimelineSavingProgressComponent: React.FC<Props> = ({ timelineId }) => {
+const TimelineSavingProgressComponent: React.FC<{ timelineId: TimelineId }> = ({ timelineId }) => {
   const getTimeline = useMemo(() => timelineSelectors.getTimelineByIdSelector(), []);
   const isSaving = useShallowEqualSelector(
     (state) => (getTimeline(state, timelineId) ?? timelineDefaults).isSaving
@@ -50,7 +54,11 @@ const TimelineSavingProgressComponent: React.FC<Props> = ({ timelineId }) => {
 
 const TimelineSavingProgress = React.memo(TimelineSavingProgressComponent);
 
-const StatefulTimelineComponent: React.FC<Props> = ({ timelineId }) => {
+const StatefulTimelineComponent: React.FC<Props> = ({
+  renderCellValue,
+  rowRenderers,
+  timelineId,
+}) => {
   const dispatch = useDispatch();
   const containerElement = useRef<HTMLDivElement | null>(null);
   const getTimeline = useMemo(() => timelineSelectors.getTimelineByIdSelector(), []);
@@ -131,6 +139,8 @@ const StatefulTimelineComponent: React.FC<Props> = ({ timelineId }) => {
 
       <TabsContent
         graphEventId={graphEventId}
+        renderCellValue={renderCellValue}
+        rowRenderers={rowRenderers}
         setTimelineFullScreen={setTimelineFullScreen}
         timelineId={timelineId}
         timelineType={timelineType}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/pinned_tab_content/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/timeline/pinned_tab_content/__snapshots__/index.test.tsx.snap
index e55c1cc8f0af3..ef73ba9f24db3 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/pinned_tab_content/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/pinned_tab_content/__snapshots__/index.test.tsx.snap
@@ -135,6 +135,986 @@ In other use cases the message field can be used to concatenate different values
   }
   onEventClosed={[MockFunction]}
   pinnedEventIds={Object {}}
+  renderCellValue={[Function]}
+  rowRenderers={
+    Array [
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_dns",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_security_event",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_security_event",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_fim",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_fim",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_fim",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_fim",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_fim",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_fim",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "alerts",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "alerts",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "alerts",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "alerts",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "alerts",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "alerts",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "alerts",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "alerts",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "alerts",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "alerts",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "library",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_fim",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "registry",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_socket",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_socket",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_socket",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_socket",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_socket",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_socket",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_socket",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_security_event",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_security_event",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_security_event",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_fim",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_fim",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_security_event",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_socket",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_socket",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "suricata",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "zeek",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "netflow",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+    ]
+  }
   showExpandedDetails={false}
   sort={
     Array [
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/pinned_tab_content/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/pinned_tab_content/index.test.tsx
index 2107969df22b8..2ea2a2e401c0f 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/pinned_tab_content/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/pinned_tab_content/index.test.tsx
@@ -10,10 +10,11 @@ import React from 'react';
 import useResizeObserver from 'use-resize-observer/polyfilled';
 
 import { Direction } from '../../../../graphql/types';
+import { DefaultCellRenderer } from '../cell_rendering/default_cell_renderer';
 import { defaultHeaders, mockTimelineData } from '../../../../common/mock';
 import '../../../../common/mock/match_media';
 import { TestProviders } from '../../../../common/mock/test_providers';
-
+import { defaultRowRenderers } from '../body/renderers';
 import { Sort } from '../body/sort';
 import { useMountAppended } from '../../../../common/utils/use_mount_appended';
 import { TimelineId, TimelineTabs } from '../../../../../common/types/timeline';
@@ -94,6 +95,8 @@ describe('PinnedTabContent', () => {
       timelineId: TimelineId.test,
       itemsPerPage: 5,
       itemsPerPageOptions: [5, 10, 20],
+      renderCellValue: DefaultCellRenderer,
+      rowRenderers: defaultRowRenderers,
       sort,
       pinnedEventIds: {},
       showExpandedDetails: false,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/pinned_tab_content/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/pinned_tab_content/index.tsx
index a19a61d8268ff..dfc14747dacf3 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/pinned_tab_content/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/pinned_tab_content/index.tsx
@@ -14,10 +14,12 @@ import { connect, ConnectedProps } from 'react-redux';
 import deepEqual from 'fast-deep-equal';
 
 import { timelineActions, timelineSelectors } from '../../../store/timeline';
+import { CellValueElementProps } from '../cell_rendering';
 import { Direction } from '../../../../../common/search_strategy';
 import { useTimelineEvents } from '../../../containers/index';
 import { defaultHeaders } from '../body/column_headers/default_headers';
 import { StatefulBody } from '../body';
+import { RowRenderer } from '../body/renderers/row_renderer';
 import { Footer, footerHeight } from '../footer';
 import { requiredFieldsForActions } from '../../../../detections/components/alerts_table/default_config';
 import { EventDetailsWidthProvider } from '../../../../common/components/events_viewer/event_details_width_context';
@@ -87,6 +89,8 @@ const VerticalRule = styled.div`
 VerticalRule.displayName = 'VerticalRule';
 
 interface OwnProps {
+  renderCellValue: (props: CellValueElementProps) => React.ReactNode;
+  rowRenderers: RowRenderer[];
   timelineId: string;
 }
 
@@ -106,6 +110,8 @@ export const PinnedTabContentComponent: React.FC<Props> = ({
   itemsPerPageOptions,
   pinnedEventIds,
   onEventClosed,
+  renderCellValue,
+  rowRenderers,
   showExpandedDetails,
   sort,
 }) => {
@@ -217,6 +223,8 @@ export const PinnedTabContentComponent: React.FC<Props> = ({
                 data={events}
                 id={timelineId}
                 refetch={refetch}
+                renderCellValue={renderCellValue}
+                rowRenderers={rowRenderers}
                 sort={sort}
                 tabType={TimelineTabs.pinned}
                 totalPages={calculateTotalPages({
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/query_tab_content/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/timeline/query_tab_content/__snapshots__/index.test.tsx.snap
index 0688a10b31eef..46c85f634ff6b 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/query_tab_content/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/query_tab_content/__snapshots__/index.test.tsx.snap
@@ -276,6 +276,986 @@ In other use cases the message field can be used to concatenate different values
   kqlMode="search"
   kqlQueryExpression=""
   onEventClosed={[MockFunction]}
+  renderCellValue={[Function]}
+  rowRenderers={
+    Array [
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "auditd",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_dns",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_security_event",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_security_event",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_fim",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_fim",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_fim",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_fim",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_fim",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_fim",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "alerts",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "alerts",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "alerts",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "alerts",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "alerts",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "alerts",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "alerts",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "alerts",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "alerts",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "alerts",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "library",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_fim",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "registry",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_socket",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_socket",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_socket",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_socket",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_socket",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_socket",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_socket",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_security_event",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_security_event",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_security_event",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_fim",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_fim",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_security_event",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_file",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_socket",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system_socket",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "system",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "suricata",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "zeek",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+      Object {
+        "id": "netflow",
+        "isInstance": [Function],
+        "renderRow": [Function],
+      },
+    ]
+  }
   show={true}
   showCallOutUnauthorizedMsg={false}
   showExpandedDetails={false}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/query_tab_content/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/query_tab_content/index.test.tsx
index c7d27da64c650..ede473acbfb2a 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/query_tab_content/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/query_tab_content/index.test.tsx
@@ -10,11 +10,13 @@ import React from 'react';
 import useResizeObserver from 'use-resize-observer/polyfilled';
 
 import { Direction } from '../../../../graphql/types';
+import { DefaultCellRenderer } from '../cell_rendering/default_cell_renderer';
 import { defaultHeaders, mockTimelineData } from '../../../../common/mock';
 import '../../../../common/mock/match_media';
 import { TestProviders } from '../../../../common/mock/test_providers';
 
 import { QueryTabContentComponent, Props as QueryTabContentComponentProps } from './index';
+import { defaultRowRenderers } from '../body/renderers';
 import { Sort } from '../body/sort';
 import { mockDataProviders } from '../data_providers/mock/mock_data_providers';
 import { useMountAppended } from '../../../../common/utils/use_mount_appended';
@@ -106,6 +108,8 @@ describe('Timeline', () => {
       kqlMode: 'search' as QueryTabContentComponentProps['kqlMode'],
       kqlQueryExpression: '',
       onEventClosed: jest.fn(),
+      renderCellValue: DefaultCellRenderer,
+      rowRenderers: defaultRowRenderers,
       showCallOutUnauthorizedMsg: false,
       showExpandedDetails: false,
       sort,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/query_tab_content/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/query_tab_content/index.tsx
index 28fec7ded9ca2..74a0f02354219 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/query_tab_content/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/query_tab_content/index.tsx
@@ -22,6 +22,8 @@ import deepEqual from 'fast-deep-equal';
 import { InPortal } from 'react-reverse-portal';
 
 import { timelineActions, timelineSelectors } from '../../../store/timeline';
+import { RowRenderer } from '../body/renderers/row_renderer';
+import { CellValueElementProps } from '../cell_rendering';
 import { Direction, TimelineItem } from '../../../../../common/search_strategy';
 import { useTimelineEvents } from '../../../containers/index';
 import { useKibana } from '../../../../common/lib/kibana';
@@ -142,6 +144,8 @@ const compareQueryProps = (prevProps: Props, nextProps: Props) =>
   deepEqual(prevProps.filters, nextProps.filters);
 
 interface OwnProps {
+  renderCellValue: (props: CellValueElementProps) => React.ReactNode;
+  rowRenderers: RowRenderer[];
   timelineId: string;
 }
 
@@ -164,6 +168,8 @@ export const QueryTabContentComponent: React.FC<Props> = ({
   kqlMode,
   kqlQueryExpression,
   onEventClosed,
+  renderCellValue,
+  rowRenderers,
   show,
   showCallOutUnauthorizedMsg,
   showExpandedDetails,
@@ -330,6 +336,8 @@ export const QueryTabContentComponent: React.FC<Props> = ({
                 data={isBlankTimeline ? EMPTY_EVENTS : events}
                 id={timelineId}
                 refetch={refetch}
+                renderCellValue={renderCellValue}
+                rowRenderers={rowRenderers}
                 sort={sort}
                 tabType={TimelineTabs.query}
                 totalPages={calculateTotalPages({
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs_content/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs_content/index.tsx
index f29211d519841..76a2ad0960322 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs_content/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs_content/index.tsx
@@ -20,6 +20,8 @@ import {
   TimelineEventsCountBadge,
 } from '../../../../common/hooks/use_timeline_events_count';
 import { timelineActions } from '../../../store/timeline';
+import { RowRenderer } from '../body/renderers/row_renderer';
+import { CellValueElementProps } from '../cell_rendering';
 import {
   getActiveTabSelector,
   getNoteIdsSelector,
@@ -46,6 +48,8 @@ const NotesTabContent = lazy(() => import('../notes_tab_content'));
 const PinnedTabContent = lazy(() => import('../pinned_tab_content'));
 
 interface BasicTimelineTab {
+  renderCellValue: (props: CellValueElementProps) => React.ReactNode;
+  rowRenderers: RowRenderer[];
   setTimelineFullScreen?: (fullScreen: boolean) => void;
   timelineFullScreen?: boolean;
   timelineId: TimelineId;
@@ -53,16 +57,32 @@ interface BasicTimelineTab {
   graphEventId?: string;
 }
 
-const QueryTab: React.FC<{ timelineId: TimelineId }> = memo(({ timelineId }) => (
+const QueryTab: React.FC<{
+  renderCellValue: (props: CellValueElementProps) => React.ReactNode;
+  rowRenderers: RowRenderer[];
+  timelineId: TimelineId;
+}> = memo(({ renderCellValue, rowRenderers, timelineId }) => (
   <Suspense fallback={<EuiLoadingContent lines={10} />}>
-    <QueryTabContent timelineId={timelineId} />
+    <QueryTabContent
+      renderCellValue={renderCellValue}
+      rowRenderers={rowRenderers}
+      timelineId={timelineId}
+    />
   </Suspense>
 ));
 QueryTab.displayName = 'QueryTab';
 
-const EqlTab: React.FC<{ timelineId: TimelineId }> = memo(({ timelineId }) => (
+const EqlTab: React.FC<{
+  renderCellValue: (props: CellValueElementProps) => React.ReactNode;
+  rowRenderers: RowRenderer[];
+  timelineId: TimelineId;
+}> = memo(({ renderCellValue, rowRenderers, timelineId }) => (
   <Suspense fallback={<EuiLoadingContent lines={10} />}>
-    <EqlTabContent timelineId={timelineId} />
+    <EqlTabContent
+      renderCellValue={renderCellValue}
+      rowRenderers={rowRenderers}
+      timelineId={timelineId}
+    />
   </Suspense>
 ));
 EqlTab.displayName = 'EqlTab';
@@ -81,9 +101,17 @@ const NotesTab: React.FC<{ timelineId: TimelineId }> = memo(({ timelineId }) =>
 ));
 NotesTab.displayName = 'NotesTab';
 
-const PinnedTab: React.FC<{ timelineId: TimelineId }> = memo(({ timelineId }) => (
+const PinnedTab: React.FC<{
+  renderCellValue: (props: CellValueElementProps) => React.ReactNode;
+  rowRenderers: RowRenderer[];
+  timelineId: TimelineId;
+}> = memo(({ renderCellValue, rowRenderers, timelineId }) => (
   <Suspense fallback={<EuiLoadingContent lines={10} />}>
-    <PinnedTabContent timelineId={timelineId} />
+    <PinnedTabContent
+      renderCellValue={renderCellValue}
+      rowRenderers={rowRenderers}
+      timelineId={timelineId}
+    />
   </Suspense>
 ));
 PinnedTab.displayName = 'PinnedTab';
@@ -91,7 +119,7 @@ PinnedTab.displayName = 'PinnedTab';
 type ActiveTimelineTabProps = BasicTimelineTab & { activeTimelineTab: TimelineTabs };
 
 const ActiveTimelineTab = memo<ActiveTimelineTabProps>(
-  ({ activeTimelineTab, timelineId, timelineType }) => {
+  ({ activeTimelineTab, renderCellValue, rowRenderers, timelineId, timelineType }) => {
     const getTab = useCallback(
       (tab: TimelineTabs) => {
         switch (tab) {
@@ -119,14 +147,26 @@ const ActiveTimelineTab = memo<ActiveTimelineTabProps>(
     return (
       <>
         <HideShowContainer $isVisible={TimelineTabs.query === activeTimelineTab}>
-          <QueryTab timelineId={timelineId} />
+          <QueryTab
+            renderCellValue={renderCellValue}
+            rowRenderers={rowRenderers}
+            timelineId={timelineId}
+          />
         </HideShowContainer>
         <HideShowContainer $isVisible={TimelineTabs.pinned === activeTimelineTab}>
-          <PinnedTab timelineId={timelineId} />
+          <PinnedTab
+            renderCellValue={renderCellValue}
+            rowRenderers={rowRenderers}
+            timelineId={timelineId}
+          />
         </HideShowContainer>
         {timelineType === TimelineType.default && (
           <HideShowContainer $isVisible={TimelineTabs.eql === activeTimelineTab}>
-            <EqlTab timelineId={timelineId} />
+            <EqlTab
+              renderCellValue={renderCellValue}
+              rowRenderers={rowRenderers}
+              timelineId={timelineId}
+            />
           </HideShowContainer>
         )}
         <HideShowContainer $isVisible={isGraphOrNotesTabs}>
@@ -160,6 +200,8 @@ const StyledEuiTab = styled(EuiTab)`
 `;
 
 const TabsContentComponent: React.FC<BasicTimelineTab> = ({
+  renderCellValue,
+  rowRenderers,
   timelineId,
   timelineFullScreen,
   timelineType,
@@ -300,6 +342,8 @@ const TabsContentComponent: React.FC<BasicTimelineTab> = ({
 
       <ActiveTimelineTab
         activeTimelineTab={activeTab}
+        renderCellValue={renderCellValue}
+        rowRenderers={rowRenderers}
         timelineId={timelineId}
         timelineType={timelineType}
       />
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_local_storage.test.tsx b/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_local_storage.test.tsx
index 3d92397f4ab50..0b70ba8991686 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_local_storage.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_local_storage.test.tsx
@@ -30,11 +30,12 @@ import {
   updateItemsPerPage,
   updateSort,
 } from './actions';
-
+import { DefaultCellRenderer } from '../../components/timeline/cell_rendering/default_cell_renderer';
 import {
   QueryTabContentComponent,
   Props as QueryTabContentComponentProps,
 } from '../../components/timeline/query_tab_content';
+import { defaultRowRenderers } from '../../components/timeline/body/renderers';
 import { mockDataProviders } from '../../components/timeline/data_providers/mock/mock_data_providers';
 import { Sort } from '../../components/timeline/body/sort';
 import { Direction } from '../../../graphql/types';
@@ -90,6 +91,8 @@ describe('epicLocalStorage', () => {
       kqlMode: 'search' as QueryTabContentComponentProps['kqlMode'],
       kqlQueryExpression: '',
       onEventClosed: jest.fn(),
+      renderCellValue: DefaultCellRenderer,
+      rowRenderers: defaultRowRenderers,
       showCallOutUnauthorizedMsg: false,
       showExpandedDetails: false,
       start: startDate,

From 1fad3175f9526882f4eab02829d73b75194e6b4e Mon Sep 17 00:00:00 2001
From: Thomas Neirynck <thomas@elastic.co>
Date: Mon, 5 Apr 2021 13:42:46 -0400
Subject: [PATCH 16/17] [Maps] Safe-erase text-field (#94873)

---
 .../properties/dynamic_text_property.test.tsx | 109 ++++++++++++++++++
 .../properties/dynamic_text_property.ts       |   4 +-
 .../properties/static_text_property.test.ts   |  70 +++++++++++
 .../vector/properties/static_text_property.ts |   4 +-
 4 files changed, 185 insertions(+), 2 deletions(-)
 create mode 100644 x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_text_property.test.tsx
 create mode 100644 x-pack/plugins/maps/public/classes/styles/vector/properties/static_text_property.test.ts

diff --git a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_text_property.test.tsx b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_text_property.test.tsx
new file mode 100644
index 0000000000000..4550a27ac2d9a
--- /dev/null
+++ b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_text_property.test.tsx
@@ -0,0 +1,109 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+jest.mock('../components/vector_style_editor', () => ({
+  VectorStyleEditor: () => {
+    return <div>mockVectorStyleEditor</div>;
+  },
+}));
+
+import React from 'react';
+
+// @ts-ignore
+import { DynamicTextProperty } from './dynamic_text_property';
+import { RawValue, VECTOR_STYLES } from '../../../../../common/constants';
+import { IField } from '../../../fields/field';
+import { Map as MbMap } from 'mapbox-gl';
+import { mockField, MockLayer, MockStyle } from './test_helpers/test_util';
+import { IVectorLayer } from '../../../layers/vector_layer';
+
+export class MockMbMap {
+  _paintPropertyCalls: unknown[];
+  _lastTextFieldValue: unknown | undefined;
+
+  constructor(lastTextFieldValue?: unknown) {
+    this._paintPropertyCalls = [];
+    this._lastTextFieldValue = lastTextFieldValue;
+  }
+  setLayoutProperty(layerId: string, propName: string, value: undefined | 'string') {
+    if (propName !== 'text-field') {
+      throw new Error('should only use to test `text-field`');
+    }
+    this._lastTextFieldValue = value;
+    this._paintPropertyCalls.push([layerId, value]);
+  }
+
+  getLayoutProperty(layername: string, propName: string): unknown | undefined {
+    if (propName !== 'text-field') {
+      throw new Error('should only use to test `text-field`');
+    }
+    return this._lastTextFieldValue;
+  }
+
+  getPaintPropertyCalls(): unknown[] {
+    return this._paintPropertyCalls;
+  }
+}
+
+const makeProperty = (mockStyle: MockStyle, field: IField | null) => {
+  return new DynamicTextProperty(
+    {},
+    VECTOR_STYLES.LABEL_TEXT,
+    field,
+    (new MockLayer(mockStyle) as unknown) as IVectorLayer,
+    () => {
+      return (value: RawValue) => value + '_format';
+    }
+  );
+};
+
+describe('syncTextFieldWithMb', () => {
+  describe('with field', () => {
+    test('Should set', async () => {
+      const dynamicTextProperty = makeProperty(new MockStyle({ min: 0, max: 100 }), mockField);
+      const mockMbMap = (new MockMbMap() as unknown) as MbMap;
+
+      dynamicTextProperty.syncTextFieldWithMb('foobar', mockMbMap);
+
+      // @ts-expect-error
+      expect(mockMbMap.getPaintPropertyCalls()).toEqual([
+        ['foobar', ['coalesce', ['get', '__kbn__dynamic__foobar__labelText'], '']],
+      ]);
+    });
+  });
+
+  describe('without field', () => {
+    test('Should clear', async () => {
+      const dynamicTextProperty = makeProperty(new MockStyle({ min: 0, max: 100 }), null);
+      const mockMbMap = (new MockMbMap([
+        'foobar',
+        ['coalesce', ['get', '__kbn__dynamic__foobar__labelText'], ''],
+      ]) as unknown) as MbMap;
+
+      dynamicTextProperty.syncTextFieldWithMb('foobar', mockMbMap);
+
+      // @ts-expect-error
+      expect(mockMbMap.getPaintPropertyCalls()).toEqual([['foobar', undefined]]);
+    });
+
+    test('Should not clear when already cleared', async () => {
+      // This verifies a weird edge-case in mapbox-gl, where setting the `text-field` layout-property to null causes tiles to be invalidated.
+      // This triggers a refetch of the tile during panning and zooming
+      // This affects vector-tile rendering in tiled_vector_layers with custom vector_styles
+      // It does _not_ affect EMS, since that does not have a code-path where a `text-field` need to be resynced.
+      // Do not remove this logic without verifying that mapbox-gl does not re-issue tile-requests for previously requested tiles
+
+      const dynamicTextProperty = makeProperty(new MockStyle({ min: 0, max: 100 }), null);
+      const mockMbMap = (new MockMbMap(undefined) as unknown) as MbMap;
+
+      dynamicTextProperty.syncTextFieldWithMb('foobar', mockMbMap);
+
+      // @ts-expect-error
+      expect(mockMbMap.getPaintPropertyCalls()).toEqual([]);
+    });
+  });
+});
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_text_property.ts b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_text_property.ts
index 22ea3067b1748..e8612388a5ae1 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_text_property.ts
+++ b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_text_property.ts
@@ -20,7 +20,9 @@ export class DynamicTextProperty extends DynamicStyleProperty<LabelDynamicOption
         '',
       ]);
     } else {
-      mbMap.setLayoutProperty(mbLayerId, 'text-field', null);
+      if (typeof mbMap.getLayoutProperty(mbLayerId, 'text-field') !== 'undefined') {
+        mbMap.setLayoutProperty(mbLayerId, 'text-field', undefined);
+      }
     }
   }
 
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/properties/static_text_property.test.ts b/x-pack/plugins/maps/public/classes/styles/vector/properties/static_text_property.test.ts
new file mode 100644
index 0000000000000..70c7721e760b6
--- /dev/null
+++ b/x-pack/plugins/maps/public/classes/styles/vector/properties/static_text_property.test.ts
@@ -0,0 +1,70 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { StaticTextProperty } from './static_text_property';
+import { VECTOR_STYLES } from '../../../../../common/constants';
+import { Map as MbMap } from 'mapbox-gl';
+
+export class MockMbMap {
+  _paintPropertyCalls: unknown[];
+  _lastTextFieldValue: unknown | undefined;
+
+  constructor(lastTextFieldValue?: unknown) {
+    this._paintPropertyCalls = [];
+    this._lastTextFieldValue = lastTextFieldValue;
+  }
+  setLayoutProperty(layerId: string, propName: string, value: undefined | 'string') {
+    if (propName !== 'text-field') {
+      throw new Error('should only use to test `text-field`');
+    }
+    this._lastTextFieldValue = value;
+    this._paintPropertyCalls.push([layerId, value]);
+  }
+
+  getLayoutProperty(layername: string, propName: string): unknown | undefined {
+    if (propName !== 'text-field') {
+      throw new Error('should only use to test `text-field`');
+    }
+    return this._lastTextFieldValue;
+  }
+
+  getPaintPropertyCalls(): unknown[] {
+    return this._paintPropertyCalls;
+  }
+}
+
+const makeProperty = (value: string) => {
+  return new StaticTextProperty({ value }, VECTOR_STYLES.LABEL_TEXT);
+};
+
+describe('syncTextFieldWithMb', () => {
+  test('Should set with value', async () => {
+    const dynamicTextProperty = makeProperty('foo');
+    const mockMbMap = (new MockMbMap() as unknown) as MbMap;
+
+    dynamicTextProperty.syncTextFieldWithMb('foobar', mockMbMap);
+
+    // @ts-expect-error
+    expect(mockMbMap.getPaintPropertyCalls()).toEqual([['foobar', 'foo']]);
+  });
+
+  test('Should not clear when already cleared', async () => {
+    // This verifies a weird edge-case in mapbox-gl, where setting the `text-field` layout-property to null causes tiles to be invalidated.
+    // This triggers a refetch of the tile during panning and zooming
+    // This affects vector-tile rendering in tiled_vector_layers with custom vector_styles
+    // It does _not_ affect EMS, since that does not have a code-path where a `text-field` need to be resynced.
+    // Do not remove this logic without verifying that mapbox-gl does not re-issue tile-requests for previously requested tiles
+
+    const dynamicTextProperty = makeProperty('');
+    const mockMbMap = (new MockMbMap(undefined) as unknown) as MbMap;
+
+    dynamicTextProperty.syncTextFieldWithMb('foobar', mockMbMap);
+
+    // @ts-expect-error
+    expect(mockMbMap.getPaintPropertyCalls()).toEqual([]);
+  });
+});
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/properties/static_text_property.ts b/x-pack/plugins/maps/public/classes/styles/vector/properties/static_text_property.ts
index b0016106b8c31..fb05fa052db21 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/properties/static_text_property.ts
+++ b/x-pack/plugins/maps/public/classes/styles/vector/properties/static_text_property.ts
@@ -18,7 +18,9 @@ export class StaticTextProperty extends StaticStyleProperty<LabelStaticOptions>
     if (this.getOptions().value.length) {
       mbMap.setLayoutProperty(mbLayerId, 'text-field', this.getOptions().value);
     } else {
-      mbMap.setLayoutProperty(mbLayerId, 'text-field', null);
+      if (typeof mbMap.getLayoutProperty(mbLayerId, 'text-field') !== 'undefined') {
+        mbMap.setLayoutProperty(mbLayerId, 'text-field', undefined);
+      }
     }
   }
 }

From ad5f83a36230abeff79d01bfff0a104f5fd615d2 Mon Sep 17 00:00:00 2001
From: Jason Stoltzfus <jastoltz24@gmail.com>
Date: Mon, 5 Apr 2021 13:49:54 -0400
Subject: [PATCH 17/17] [App Search] Added Sample Response section to Result
 Settings (#95971)

---
 .../result_settings/result_settings.tsx       |   4 +-
 .../non_text_fields_body.tsx                  |   5 +
 .../text_fields_body.tsx                      |  13 ++
 .../result_settings/sample_response/index.ts  |   8 +
 .../sample_response/sample_response.test.tsx  |  75 ++++++
 .../sample_response/sample_response.tsx       |  72 ++++++
 .../sample_response_logic.test.ts             | 214 ++++++++++++++++++
 .../sample_response/sample_response_logic.ts  | 100 ++++++++
 .../components/result_settings/types.ts       |   4 +
 .../routes/app_search/result_settings.test.ts |  44 ++++
 .../routes/app_search/result_settings.ts      |  18 ++
 11 files changed, 556 insertions(+), 1 deletion(-)
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/sample_response/index.ts
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/sample_response/sample_response.test.tsx
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/sample_response/sample_response.tsx
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/sample_response/sample_response_logic.test.ts
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/sample_response/sample_response_logic.ts

diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/result_settings.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/result_settings.tsx
index 38db5c60e98a9..7f4373835f8d5 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/result_settings.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/result_settings.tsx
@@ -17,6 +17,8 @@ import { SetAppSearchChrome as SetPageChrome } from '../../../shared/kibana_chro
 import { RESULT_SETTINGS_TITLE } from './constants';
 import { ResultSettingsTable } from './result_settings_table';
 
+import { SampleResponse } from './sample_response';
+
 import { ResultSettingsLogic } from '.';
 
 interface Props {
@@ -40,7 +42,7 @@ export const ResultSettings: React.FC<Props> = ({ engineBreadcrumb }) => {
           <ResultSettingsTable />
         </EuiFlexItem>
         <EuiFlexItem grow={3}>
-          <div>TODO</div>
+          <SampleResponse />
         </EuiFlexItem>
       </EuiFlexGroup>
     </>
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/result_settings_table/non_text_fields_body.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/result_settings_table/non_text_fields_body.tsx
index 145654be20461..dc91b5039a3c9 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/result_settings_table/non_text_fields_body.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/result_settings_table/non_text_fields_body.tsx
@@ -10,6 +10,7 @@ import React, { useMemo } from 'react';
 import { useValues, useActions } from 'kea';
 
 import { EuiTableRow, EuiTableRowCell, EuiCheckbox, EuiTableRowCellCheckbox } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
 
 import { ResultSettingsLogic } from '..';
 import { FieldResultSetting } from '../types';
@@ -33,6 +34,10 @@ export const NonTextFieldsBody: React.FC = () => {
           </EuiTableRowCell>
           <EuiTableRowCellCheckbox>
             <EuiCheckbox
+              aria-label={i18n.translate(
+                'xpack.enterpriseSearch.appSearch.engine.resultSettings.table.rawAriaLabel',
+                { defaultMessage: 'Toggle raw field' }
+              )}
               data-test-subj="ResultSettingRawCheckBox"
               id={`${fieldName}-raw}`}
               checked={!!fieldSettings.raw}
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/result_settings_table/text_fields_body.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/result_settings_table/text_fields_body.tsx
index 0f7e6f5e0eb1d..3a2eb20fecdf0 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/result_settings_table/text_fields_body.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/result_settings_table/text_fields_body.tsx
@@ -10,6 +10,7 @@ import React, { useMemo } from 'react';
 import { useValues, useActions } from 'kea';
 
 import { EuiTableRow, EuiTableRowCell, EuiTableRowCellCheckbox, EuiCheckbox } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
 
 import { ResultSettingsLogic } from '../result_settings_logic';
 import { FieldResultSetting } from '../types';
@@ -43,6 +44,10 @@ export const TextFieldsBody: React.FC = () => {
           </EuiTableRowCell>
           <EuiTableRowCellCheckbox>
             <EuiCheckbox
+              aria-label={i18n.translate(
+                'xpack.enterpriseSearch.appSearch.engine.resultSettings.table.rawAriaLabel',
+                { defaultMessage: 'Toggle raw field' }
+              )}
               data-test-subj="ResultSettingRawCheckBox"
               id={`${fieldName}-raw}`}
               checked={!!fieldSettings.raw}
@@ -63,6 +68,10 @@ export const TextFieldsBody: React.FC = () => {
           </EuiTableRowCell>
           <EuiTableRowCellCheckbox>
             <EuiCheckbox
+              aria-label={i18n.translate(
+                'xpack.enterpriseSearch.appSearch.engine.resultSettings.table.snippetAriaLabel',
+                { defaultMessage: 'Toggle text snippet' }
+              )}
               data-test-subj="ResultSettingSnippetTextBox"
               id={`${fieldName}-snippet}`}
               checked={!!fieldSettings.snippet}
@@ -73,6 +82,10 @@ export const TextFieldsBody: React.FC = () => {
           </EuiTableRowCellCheckbox>
           <EuiTableRowCellCheckbox>
             <EuiCheckbox
+              aria-label={i18n.translate(
+                'xpack.enterpriseSearch.appSearch.engine.resultSettings.table.snippetFallbackAriaLabel',
+                { defaultMessage: 'Toggle snippet fallback' }
+              )}
               data-test-subj="ResultSettingFallbackTextBox"
               id={`${fieldName}-snippetFallback}`}
               checked={fieldSettings.snippetFallback}
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/sample_response/index.ts b/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/sample_response/index.ts
new file mode 100644
index 0000000000000..257ad27fe8748
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/sample_response/index.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export { SampleResponse } from './sample_response';
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/sample_response/sample_response.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/sample_response/sample_response.test.tsx
new file mode 100644
index 0000000000000..e324150a2d52a
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/sample_response/sample_response.test.tsx
@@ -0,0 +1,75 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import '../../../../__mocks__/shallow_useeffect.mock';
+import { setMockActions, setMockValues } from '../../../../__mocks__';
+
+import React from 'react';
+
+import { shallow } from 'enzyme';
+
+import { EuiCodeBlock, EuiFieldSearch } from '@elastic/eui';
+
+import { SampleResponse } from './sample_response';
+
+describe('SampleResponse', () => {
+  const actions = {
+    queryChanged: jest.fn(),
+    getSearchResults: jest.fn(),
+  };
+
+  const values = {
+    reducedServerResultFields: {},
+    query: 'foo',
+    response: {
+      bar: 'baz',
+    },
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    setMockActions(actions);
+    setMockValues(values);
+  });
+
+  it('renders a text box with the current user "query" value from state', () => {
+    const wrapper = shallow(<SampleResponse />);
+    expect(wrapper.find(EuiFieldSearch).prop('value')).toEqual('foo');
+  });
+
+  it('updates the "query" value in state when a user updates the text in the text box', () => {
+    const wrapper = shallow(<SampleResponse />);
+    wrapper.find(EuiFieldSearch).simulate('change', { target: { value: 'bar' } });
+    expect(actions.queryChanged).toHaveBeenCalledWith('bar');
+  });
+
+  it('will call getSearchResults with the current value of query and reducedServerResultFields in a useEffect, which updates the displayed response', () => {
+    const wrapper = shallow(<SampleResponse />);
+    expect(wrapper.find(EuiFieldSearch).prop('value')).toEqual('foo');
+  });
+
+  it('renders the response from the given user "query" in a code block', () => {
+    const wrapper = shallow(<SampleResponse />);
+    expect(wrapper.find(EuiCodeBlock).prop('children')).toEqual('{\n  "bar": "baz"\n}');
+  });
+
+  it('renders a plain old string in the code block if the response is a string', () => {
+    setMockValues({
+      response: 'No results.',
+    });
+    const wrapper = shallow(<SampleResponse />);
+    expect(wrapper.find(EuiCodeBlock).prop('children')).toEqual('No results.');
+  });
+
+  it('will not render a code block at all if there is no response yet', () => {
+    setMockValues({
+      response: null,
+    });
+    const wrapper = shallow(<SampleResponse />);
+    expect(wrapper.find(EuiCodeBlock).exists()).toEqual(false);
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/sample_response/sample_response.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/sample_response/sample_response.tsx
new file mode 100644
index 0000000000000..ae91b9648356c
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/sample_response/sample_response.tsx
@@ -0,0 +1,72 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useEffect } from 'react';
+
+import { useActions, useValues } from 'kea';
+
+import {
+  EuiCodeBlock,
+  EuiFieldSearch,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiPanel,
+  EuiSpacer,
+  EuiTitle,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+
+import { ResultSettingsLogic } from '../result_settings_logic';
+
+import { SampleResponseLogic } from './sample_response_logic';
+
+export const SampleResponse: React.FC = () => {
+  const { reducedServerResultFields } = useValues(ResultSettingsLogic);
+
+  const { query, response } = useValues(SampleResponseLogic);
+  const { queryChanged, getSearchResults } = useActions(SampleResponseLogic);
+
+  useEffect(() => {
+    getSearchResults(query, reducedServerResultFields);
+  }, [query, reducedServerResultFields]);
+
+  return (
+    <EuiPanel hasBorder>
+      <EuiFlexGroup alignItems="center">
+        <EuiFlexItem>
+          <EuiTitle size="s">
+            <h2>
+              {i18n.translate(
+                'xpack.enterpriseSearch.appSearch.engine.resultSettings.sampleResponseTitle',
+                { defaultMessage: 'Sample response' }
+              )}
+            </h2>
+          </EuiTitle>
+        </EuiFlexItem>
+        <EuiFlexItem grow={false}>
+          {/* TODO <QueryPerformance queryPerformanceRating={queryPerformanceRating} /> */}
+        </EuiFlexItem>
+      </EuiFlexGroup>
+      <EuiSpacer />
+      <EuiFieldSearch
+        value={query}
+        onChange={(e) => queryChanged(e.target.value)}
+        placeholder={i18n.translate(
+          'xpack.enterpriseSearch.appSearch.engine.resultSettings.sampleResponse.inputPlaceholder',
+          { defaultMessage: 'Type a search query to test a response...' }
+        )}
+        data-test-subj="ResultSettingsQuerySampleResponse"
+      />
+      <EuiSpacer />
+      {!!response && (
+        <EuiCodeBlock language="json" whiteSpace="pre-wrap">
+          {typeof response === 'string' ? response : JSON.stringify(response, null, 2)}
+        </EuiCodeBlock>
+      )}
+    </EuiPanel>
+  );
+};
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/sample_response/sample_response_logic.test.ts b/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/sample_response/sample_response_logic.test.ts
new file mode 100644
index 0000000000000..79379306c1618
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/sample_response/sample_response_logic.test.ts
@@ -0,0 +1,214 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { LogicMounter, mockHttpValues } from '../../../../__mocks__';
+import '../../../__mocks__/engine_logic.mock';
+
+import { nextTick } from '@kbn/test/jest';
+
+import { flashAPIErrors } from '../../../../shared/flash_messages';
+
+import { SampleResponseLogic } from './sample_response_logic';
+
+describe('SampleResponseLogic', () => {
+  const { mount } = new LogicMounter(SampleResponseLogic);
+  const { http } = mockHttpValues;
+
+  const DEFAULT_VALUES = {
+    query: '',
+    response: null,
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('has expected default values', () => {
+    mount();
+    expect(SampleResponseLogic.values).toEqual({
+      ...DEFAULT_VALUES,
+    });
+  });
+
+  describe('actions', () => {
+    describe('queryChanged', () => {
+      it('updates the query', () => {
+        mount({
+          query: '',
+        });
+
+        SampleResponseLogic.actions.queryChanged('foo');
+
+        expect(SampleResponseLogic.values).toEqual({
+          ...DEFAULT_VALUES,
+          query: 'foo',
+        });
+      });
+    });
+
+    describe('getSearchResultsSuccess', () => {
+      it('sets the response from a search API request', () => {
+        mount({
+          response: null,
+        });
+
+        SampleResponseLogic.actions.getSearchResultsSuccess({});
+
+        expect(SampleResponseLogic.values).toEqual({
+          ...DEFAULT_VALUES,
+          response: {},
+        });
+      });
+    });
+
+    describe('getSearchResultsFailure', () => {
+      it('sets a string response from a search API request', () => {
+        mount({
+          response: null,
+        });
+
+        SampleResponseLogic.actions.getSearchResultsFailure('An error occured.');
+
+        expect(SampleResponseLogic.values).toEqual({
+          ...DEFAULT_VALUES,
+          response: 'An error occured.',
+        });
+      });
+    });
+  });
+
+  describe('listeners', () => {
+    describe('getSearchResults', () => {
+      beforeAll(() => jest.useFakeTimers());
+      afterAll(() => jest.useRealTimers());
+
+      it('makes a search API request and calls getSearchResultsSuccess with the first result of the response', async () => {
+        mount();
+        jest.spyOn(SampleResponseLogic.actions, 'getSearchResultsSuccess');
+
+        http.post.mockReturnValue(
+          Promise.resolve({
+            results: [
+              { id: { raw: 'foo' }, _meta: {} },
+              { id: { raw: 'bar' }, _meta: {} },
+              { id: { raw: 'baz' }, _meta: {} },
+            ],
+          })
+        );
+
+        SampleResponseLogic.actions.getSearchResults('foo', { foo: { raw: true } });
+        jest.runAllTimers();
+        await nextTick();
+
+        expect(SampleResponseLogic.actions.getSearchResultsSuccess).toHaveBeenCalledWith({
+          // Note that the _meta field was stripped from the result
+          id: { raw: 'foo' },
+        });
+      });
+
+      it('calls getSearchResultsSuccess with a "No Results." message if there are no results', async () => {
+        mount();
+        jest.spyOn(SampleResponseLogic.actions, 'getSearchResultsSuccess');
+
+        http.post.mockReturnValue(
+          Promise.resolve({
+            results: [],
+          })
+        );
+
+        SampleResponseLogic.actions.getSearchResults('foo', { foo: { raw: true } });
+        jest.runAllTimers();
+        await nextTick();
+
+        expect(SampleResponseLogic.actions.getSearchResultsSuccess).toHaveBeenCalledWith(
+          'No results.'
+        );
+      });
+
+      it('handles 500 errors by setting a generic error response and showing a flash message error', async () => {
+        mount();
+        jest.spyOn(SampleResponseLogic.actions, 'getSearchResultsFailure');
+
+        const error = {
+          response: {
+            status: 500,
+          },
+        };
+
+        http.post.mockReturnValueOnce(Promise.reject(error));
+
+        SampleResponseLogic.actions.getSearchResults('foo', { foo: { raw: true } });
+        jest.runAllTimers();
+        await nextTick();
+
+        expect(flashAPIErrors).toHaveBeenCalledWith(error);
+        expect(SampleResponseLogic.actions.getSearchResultsFailure).toHaveBeenCalledWith(
+          'An error occured.'
+        );
+      });
+
+      it('handles 400 errors by setting the response, but does not show a flash error message', async () => {
+        mount();
+        jest.spyOn(SampleResponseLogic.actions, 'getSearchResultsFailure');
+
+        http.post.mockReturnValueOnce(
+          Promise.reject({
+            response: {
+              status: 400,
+            },
+            body: {
+              attributes: {
+                errors: ['A validation error occurred.'],
+              },
+            },
+          })
+        );
+
+        SampleResponseLogic.actions.getSearchResults('foo', { foo: { raw: true } });
+        jest.runAllTimers();
+        await nextTick();
+
+        expect(SampleResponseLogic.actions.getSearchResultsFailure).toHaveBeenCalledWith({
+          errors: ['A validation error occurred.'],
+        });
+      });
+
+      it('sets a generic message on a 400 error if no custom message is provided in the response', async () => {
+        mount();
+        jest.spyOn(SampleResponseLogic.actions, 'getSearchResultsFailure');
+
+        http.post.mockReturnValueOnce(
+          Promise.reject({
+            response: {
+              status: 400,
+            },
+          })
+        );
+
+        SampleResponseLogic.actions.getSearchResults('foo', { foo: { raw: true } });
+        jest.runAllTimers();
+        await nextTick();
+
+        expect(SampleResponseLogic.actions.getSearchResultsFailure).toHaveBeenCalledWith(
+          'An error occured.'
+        );
+      });
+
+      it('does nothing if an empty object is passed for the resultFields parameter', async () => {
+        mount();
+        jest.spyOn(SampleResponseLogic.actions, 'getSearchResultsSuccess');
+
+        SampleResponseLogic.actions.getSearchResults('foo', {});
+
+        jest.runAllTimers();
+        await nextTick();
+
+        expect(SampleResponseLogic.actions.getSearchResultsSuccess).not.toHaveBeenCalled();
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/sample_response/sample_response_logic.ts b/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/sample_response/sample_response_logic.ts
new file mode 100644
index 0000000000000..808a7ec9c65dc
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/sample_response/sample_response_logic.ts
@@ -0,0 +1,100 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { kea, MakeLogicType } from 'kea';
+
+import { i18n } from '@kbn/i18n';
+
+import { flashAPIErrors } from '../../../../shared/flash_messages';
+
+import { HttpLogic } from '../../../../shared/http';
+import { EngineLogic } from '../../engine';
+
+import { SampleSearchResponse, ServerFieldResultSettingObject } from '../types';
+
+const NO_RESULTS_MESSAGE = i18n.translate(
+  'xpack.enterpriseSearch.appSearch.engine.resultSettings.sampleResponse.noResultsMessage',
+  { defaultMessage: 'No results.' }
+);
+
+const ERROR_MESSAGE = i18n.translate(
+  'xpack.enterpriseSearch.appSearch.engine.resultSettings.sampleResponse.errorMessage',
+  { defaultMessage: 'An error occured.' }
+);
+
+interface SampleResponseValues {
+  query: string;
+  response: SampleSearchResponse | string | null;
+}
+
+interface SampleResponseActions {
+  queryChanged: (query: string) => { query: string };
+  getSearchResultsSuccess: (
+    response: SampleSearchResponse | string
+  ) => { response: SampleSearchResponse | string };
+  getSearchResultsFailure: (response: string) => { response: string };
+  getSearchResults: (
+    query: string,
+    resultFields: ServerFieldResultSettingObject
+  ) => { query: string; resultFields: ServerFieldResultSettingObject };
+}
+
+export const SampleResponseLogic = kea<MakeLogicType<SampleResponseValues, SampleResponseActions>>({
+  path: ['enterprise_search', 'app_search', 'sample_response_logic'],
+  actions: {
+    queryChanged: (query) => ({ query }),
+    getSearchResultsSuccess: (response) => ({ response }),
+    getSearchResultsFailure: (response) => ({ response }),
+    getSearchResults: (query, resultFields) => ({ query, resultFields }),
+  },
+  reducers: {
+    query: ['', { queryChanged: (_, { query }) => query }],
+    response: [
+      null,
+      {
+        getSearchResultsSuccess: (_, { response }) => response,
+        getSearchResultsFailure: (_, { response }) => response,
+      },
+    ],
+  },
+  listeners: ({ actions }) => ({
+    getSearchResults: async ({ query, resultFields }, breakpoint) => {
+      if (Object.keys(resultFields).length < 1) return;
+      await breakpoint(250);
+
+      const { http } = HttpLogic.values;
+      const { engineName } = EngineLogic.values;
+
+      const url = `/api/app_search/engines/${engineName}/sample_response_search`;
+
+      try {
+        const response = await http.post(url, {
+          body: JSON.stringify({
+            query,
+            result_fields: resultFields,
+          }),
+        });
+
+        const result = response.results?.[0];
+        actions.getSearchResultsSuccess(
+          result ? { ...result, _meta: undefined } : NO_RESULTS_MESSAGE
+        );
+      } catch (e) {
+        if (e.response.status >= 500) {
+          // 4XX Validation errors are expected, as a user could enter something like 2 as a size, which is out of valid range.
+          // In this case, we simply render the message from the server as the response.
+          //
+          // 5xx Server errors are unexpected, and need to be reported in a flash message.
+          flashAPIErrors(e);
+          actions.getSearchResultsFailure(ERROR_MESSAGE);
+        } else {
+          actions.getSearchResultsFailure(e.body?.attributes || ERROR_MESSAGE);
+        }
+      }
+    },
+  }),
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/types.ts b/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/types.ts
index 96bf277314a7b..18843112f46bf 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/types.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/result_settings/types.ts
@@ -5,6 +5,8 @@
  * 2.0.
  */
 
+import { FieldValue } from '../result/types';
+
 export enum OpenModal {
   None,
   ConfirmResetModal,
@@ -35,3 +37,5 @@ export interface FieldResultSetting {
 }
 
 export type FieldResultSettingObject = Record<string, FieldResultSetting | {}>;
+
+export type SampleSearchResponse = Record<string, FieldValue>;
diff --git a/x-pack/plugins/enterprise_search/server/routes/app_search/result_settings.test.ts b/x-pack/plugins/enterprise_search/server/routes/app_search/result_settings.test.ts
index 8d1a7e3ead37b..e38380d60c6e9 100644
--- a/x-pack/plugins/enterprise_search/server/routes/app_search/result_settings.test.ts
+++ b/x-pack/plugins/enterprise_search/server/routes/app_search/result_settings.test.ts
@@ -88,4 +88,48 @@ describe('result settings routes', () => {
       });
     });
   });
+
+  describe('POST /api/app_search/engines/{name}/sample_response_search', () => {
+    const mockRouter = new MockRouter({
+      method: 'post',
+      path: '/api/app_search/engines/{engineName}/sample_response_search',
+    });
+
+    beforeEach(() => {
+      registerResultSettingsRoutes({
+        ...mockDependencies,
+        router: mockRouter.router,
+      });
+    });
+
+    it('creates a request to enterprise search', () => {
+      mockRouter.callRoute({
+        params: { engineName: 'some-engine' },
+        body: {
+          query: 'test',
+          result_fields: resultFields,
+        },
+      });
+
+      expect(mockRequestHandler.createRequest).toHaveBeenCalledWith({
+        path: '/as/engines/:engineName/sample_response_search',
+      });
+    });
+
+    describe('validates', () => {
+      it('correctly', () => {
+        const request = {
+          body: {
+            query: 'test',
+            result_fields: resultFields,
+          },
+        };
+        mockRouter.shouldValidate(request);
+      });
+      it('missing required fields', () => {
+        const request = { body: {} };
+        mockRouter.shouldThrow(request);
+      });
+    });
+  });
 });
diff --git a/x-pack/plugins/enterprise_search/server/routes/app_search/result_settings.ts b/x-pack/plugins/enterprise_search/server/routes/app_search/result_settings.ts
index 38cb4aa922738..b091ae7a539c2 100644
--- a/x-pack/plugins/enterprise_search/server/routes/app_search/result_settings.ts
+++ b/x-pack/plugins/enterprise_search/server/routes/app_search/result_settings.ts
@@ -45,4 +45,22 @@ export function registerResultSettingsRoutes({
       path: '/as/engines/:engineName/result_settings',
     })
   );
+
+  router.post(
+    {
+      path: '/api/app_search/engines/{engineName}/sample_response_search',
+      validate: {
+        params: schema.object({
+          engineName: schema.string(),
+        }),
+        body: schema.object({
+          query: schema.string(),
+          result_fields: schema.recordOf(schema.string(), schema.object({}, { unknowns: 'allow' })),
+        }),
+      },
+    },
+    enterpriseSearchRequestHandler.createRequest({
+      path: '/as/engines/:engineName/sample_response_search',
+    })
+  );
 }