Merge branch 'master' into rac-add-observability-test-user-service

.github/CODEOWNERS

@@ -16,10 +16,11 @@
 /src/plugins/discover/ @elastic/kibana-data-discovery
 /x-pack/plugins/discover_enhanced/ @elastic/kibana-data-discovery
 /test/functional/apps/discover/ @elastic/kibana-data-discovery
+/x-pack/plugins/graph/ @elastic/kibana-data-discovery
+/x-pack/test/functional/apps/graph @elastic/kibana-data-discovery
 
 # Vis Editors
 /x-pack/plugins/lens/ @elastic/kibana-vis-editors
-/x-pack/plugins/graph/ @elastic/kibana-vis-editors
 /src/plugins/advanced_settings/ @elastic/kibana-vis-editors
 /src/plugins/charts/ @elastic/kibana-vis-editors
 /src/plugins/management/ @elastic/kibana-vis-editors

.github/workflows/sync-main-branch.yml

@@ -9,6 +9,7 @@ jobs:
   sync_latest_from_upstream:
     runs-on: ubuntu-latest
     name: Sync latest commits from master branch
+    if: github.repository == 'elastic/kibana'
 
     steps:
       - name: Checkout target repo

docs/developer/plugin-list.asciidoc

@@ -350,7 +350,7 @@ The plugin exposes the static DefaultEditorController class to consume.
 
 
 |{kib-repo}blob/{branch}/x-pack/plugins/apm/readme.md[apm]
-|To access an elasticsearch instance that has live data you have two options:
+|Local setup documentation
 
 
 |{kib-repo}blob/{branch}/x-pack/plugins/banners/README.md[banners]

docs/development/core/public/kibana-plugin-core-public.doclinksstart.links.md

@@ -12,6 +12,7 @@ readonly links: {
         readonly apm: {
             readonly kibanaSettings: string;
             readonly supportedServiceMaps: string;
+            readonly metaData: string;
         };
         readonly canvas: {
             readonly guide: string;

docs/development/core/server/kibana-plugin-core-server.deprecationsservicesetup.md

@@ -31,10 +31,10 @@ async function getDeprecations({ esClient, savedObjectsClient }: GetDeprecations
     // Example of a manual correctiveAction
     deprecations.push({
       title: i18n.translate('xpack.timelion.deprecations.worksheetsTitle', {
-        defaultMessage: 'Found Timelion worksheets.'
+        defaultMessage: 'Timelion worksheets are deprecated'
       }),
       message: i18n.translate('xpack.timelion.deprecations.worksheetsMessage', {
-        defaultMessage: 'You have {count} Timelion worksheets. The Timelion app will be removed in 8.0. To continue using your Timelion worksheets, migrate them to a dashboard.',
+        defaultMessage: 'You have {count} Timelion worksheets. Migrate your Timelion worksheets to a dashboard to continue using them.',
         values: { count },
       }),
       documentationUrl:

docs/management/connectors/action-types/email.asciidoc

@@ -51,7 +51,7 @@ Use the <<action-settings, Action configuration settings>> to customize connecto
 
 Config defines information for the connector type.
 
-`service`:: The name of a https://nodemailer.com/smtp/well-known/[well-known email service provider]. If `service` is provided, `host`, `port`, and `secure` properties are ignored. For more information on the `gmail` service value, see the https://nodemailer.com/usage/using-gmail/[Nodemailer Gmail documentation].
+`service`:: The name of the email service. If `service` is `elastic_cloud` (for Elastic Cloud notifications) or one of Nodemailer's https://nodemailer.com/smtp/well-known/[well-known email service providers], `host`, `port`, and `secure` properties are ignored. If `service` is `other`, `host` and `port` properties must be defined. For more information on the `gmail` service value, see the https://nodemailer.com/usage/using-gmail/[Nodemailer Gmail documentation].
 `from`:: An email address that corresponds to *Sender*.
 `host`:: A string that corresponds to *Host*.
 `port`:: A number that corresponds to *Port*.
@@ -107,7 +107,7 @@ For other email servers, you can check the list of well-known services that Node
 [[elasticcloud]]
 ==== Sending email from Elastic Cloud
 
-IMPORTANT: These instructions require you to link:{cloud}/ec-watcher.html#ec-watcher-whitelist[whitelist] the email addresses that notifications get sent first.
+IMPORTANT: These instructions require you to link:{cloud}/ec-watcher.html#ec-watcher-whitelist[allowlist] the email addresses that notifications get sent.
 
 Use the following connector settings to send email from Elastic Cloud: 
 

docs/settings/logging-settings.asciidoc

@@ -4,6 +4,16 @@
 <titleabbrev>Logging settings</titleabbrev>
 ++++
 
+{kib} relies on three high-level entities to set the logging service: appenders, loggers, and root.
+
+- Appenders define where log messages are displayed (stdout or console) and their layout (`pattern` or `json`). They also allow you to specify if you want the logs stored and, if so, where (file on the disk).
+- Loggers define what logging settings, such as the level of verbosity and the appenders, to apply to a particular context. Each log entry context provides information about the service or plugin that emits it and any of its sub-parts, for example, `metrics.ops` or `elasticsearch.query`.
+- Root is a logger that applies to all the log entries in {kib}.
+
+Refer to the <<log-settings-examples, examples>> for common configuration use cases. To learn more about possible configuration values, go to {kibana-ref}/logging-service.html[{kib}'s Logging service].
+
+[[log-settings-compatibility]]
+==== Backwards compatibility
 Compatibility with the legacy logging system is assured until the end of the `v7` version.
 All log messages handled by `root` context (default) are forwarded to the legacy logging service.
 The logging configuration is validated against the predefined schema and if there are
@@ -12,10 +22,12 @@ any issues with it, {kib} will fail to start with the detailed error message.
 NOTE: When you switch to the new logging configuration, you will start seeing duplicate log entries in both formats. 
 These will be removed when the `default` appender is no longer required.
 
+[[log-settings-examples]]
+==== Examples
 Here are some configuration examples for the most common logging use cases:
 
 [[log-to-file-example]]
-==== Log to a file
+===== Log to a file
 
 Log the default log format to a file instead of to stdout (the default).
 
@@ -33,10 +45,10 @@ logging:
 ----
 
 [[log-in-json-ECS-example]]
-==== Log in json format
+===== Log in JSON format
 
-Log the default log format to json layout instead of pattern (the default).
-With `json` layout log messages will be formatted as JSON strings in https://www.elastic.co/guide/en/ecs/current/ecs-reference.html[ECS format] that includes a timestamp, log level, logger, message text and any other metadata that may be associated with the log message itself
+Log the default log format to JSON layout instead of pattern (the default).
+With `json` layout, log messages will be formatted as JSON strings in https://www.elastic.co/guide/en/ecs/current/ecs-reference.html[ECS format] that includes a timestamp, log level, logger, message text and any other metadata that may be associated with the log message itself.
 
 [source,yaml]
 ----
@@ -51,7 +63,7 @@ logging:
 ----
 
 [[log-with-meta-to-stdout]]
-==== Log with meta to stdout
+===== Log with meta to stdout
 
 Include `%meta` in your pattern layout:
 
@@ -69,7 +81,7 @@ logging:
 ----
 
 [[log-elasticsearch-queries]]
-==== Log {es} queries
+===== Log {es} queries
 
 [source,yaml]
 --
@@ -89,7 +101,7 @@ logging:
 --
 
 [[change-overall-log-level]]
-==== Change overall log level.
+===== Change overall log level
 
 [source,yaml]
 ----
@@ -99,7 +111,7 @@ logging:
 ----
 
 [[customize-specific-log-records]]
-==== Customize specific log records
+===== Customize specific log records
 Here is a detailed configuration example that can be used to configure _loggers_, _appenders_ and _layouts_:
 
 [source,yaml]

docs/setup/settings.asciidoc

@@ -295,12 +295,6 @@ is an alternative to `elasticsearch.username` and `elasticsearch.password`.
 | `interpreter.enableInVisualize`
   | Enables use of interpreter in Visualize. *Default: `true`*
 
-| `kibana.defaultAppId:`
- | deprecated:[7.9.0,This setting will be removed in Kibana 8.0.]
- Instead, use the <<defaultroute,`defaultRoute` advanced setting>>.
- +
- The default application to load. *Default: `"home"`*
-
 |[[kibana-index]] `kibana.index:`
  | deprecated:[7.11.0,This setting will be removed in 8.0.] Multitenancy by
  changing `kibana.index` will not be supported starting in 8.0. See

docs/user/alerting/rule-types/es-query.asciidoc

@@ -60,4 +60,32 @@ image::user/alerting/images/rule-types-es-query-valid.png[Test {es} query return
 * An error message is shown if the query is invalid.
 +
 [role="screenshot"]
-image::user/alerting/images/rule-types-es-query-invalid.png[Test {es} query shows error when invalid]
+image::user/alerting/images/rule-types-es-query-invalid.png[Test {es} query shows error when invalid]
+
+[float]
+==== Match de-duplication
+
+The {es} query rule type performs de-duplication of document matches across rule executions. If you configure the rule with a schedule interval smaller than the time window, and a document matches a query in multiple rule executions, it will be alerted on only once.
+
+Suppose you have a rule configured to run every minute.  The rule uses a time window of 1 hour and checks if there are more than 99 matches for the query. The {es} query rule type will do the following:
+
+[cols="3*<"]
+|===
+
+| `Execution 1 (0:00)`
+| Rule finds 113 matches in the last hour: `113 > 99`
+| Rule is active and user will be alerted.
+
+| `Execution 2 (0:01)`
+| Rule finds 127 matches in the last hour. 105 of the matches are duplicates that were alerted on in Execution 1, so you actually have 22 matches: `22 !> 99`
+| No alert.
+
+| `Execution 3 (0:02)`
+| Rule finds 159 matches in the last hour. 88 of the matches are duplicates that were alerted on in Execution 1, so you actually have 71 matches: `71 !> 99`
+| No alert.
+
+| `Execution 4 (0:03)`
+| Rule finds 190 matches in the last hour. 71 of them are duplicates that were alerted on in Exeuction 1, so you actually have 119 matches: `119 > 99`
+| Rule is active and user will be alerted.
+
+|===

docs/user/alerting/troubleshooting/alerting-common-issues.asciidoc

@@ -68,7 +68,7 @@ Rules  are taking a long time to execute and are impacting the overall health of
 
 [IMPORTANT]
 ==============================================
-By default, only users with a `superuser` role can query the {kib} event log because it is a system index. To enable additional users to execute this query, assign `read` privileges to the `.kibana-event-log*` index.
+By default, only users with a `superuser` role can query the experimental[] {kib} event log because it is a system index. To enable additional users to execute this query, assign `read` privileges to the `.kibana-event-log*` index.
 ==============================================
 
 *Solution*

docs/user/alerting/troubleshooting/event-log-index.asciidoc

@@ -2,6 +2,8 @@
 [[event-log-index]]
 === Event log index
 
+experimental[]
+
 Use the event log index to determine:
 
 * Whether a rule successfully ran but its associated actions did not

docs/user/production-considerations/alerting-production-considerations.asciidoc

@@ -54,6 +54,8 @@ Predicting the buffer required to account for actions depends heavily on the rul
 [[event-log-ilm]]
 === Event log index lifecycle managment
 
+experimental[]
+
 Alerts and actions log activity in a set of "event log" indices.  These indices are configured with an index lifecycle management (ILM) policy, which you can customize.  The default policy rolls over the index when it reaches 50GB, or after 30 days.  Indices over 90 days old are deleted.
 
 The name of the index policy is `kibana-event-log-policy`.  {kib} creates the index policy on startup, if it doesn't already exist.  The index policy can be customized for your environment, but {kib} never modifies the index policy after creating it.

package.json

@@ -348,7 +348,7 @@
     "react-moment-proptypes": "^1.7.0",
     "react-monaco-editor": "^0.41.2",
     "react-popper-tooltip": "^2.10.1",
-    "react-query": "^3.21.0",
+    "react-query": "^3.21.1",
     "react-redux": "^7.2.0",
     "react-resizable": "^1.7.5",
     "react-resize-detector": "^4.2.0",

packages/kbn-ace/BUILD.bazel

@@ -45,6 +45,8 @@ jsts_transpiler(
   srcs = SRCS,
   additional_args = [
     "--copy-files",
+    "--ignore",
+    "**/*/src/ace/modes/x_json/worker/x_json.ace.worker.js",
     "--quiet"
   ],
   build_pkg_name = package_name(),

packages/kbn-alerts/BUILD.bazel

@@ -57,7 +57,7 @@ jsts_transpiler(
   name = "target_web",
   srcs = SRCS,
   build_pkg_name = package_name(),
-  config_file = ".babelrc.browser"
+  web = True,
 )
 
 ts_config(

packages/kbn-analytics/BUILD.bazel

@@ -42,7 +42,7 @@ jsts_transpiler(
   name = "target_web",
   srcs = SRCS,
   build_pkg_name = package_name(),
-  config_file = ".babelrc.browser"
+  web = True,
 )
 
 ts_config(

packages/kbn-es-query/BUILD.bazel

@@ -76,7 +76,7 @@ jsts_transpiler(
   name = "target_web",
   srcs = SRCS,
   build_pkg_name = package_name(),
-  config_file = ".babelrc.browser"
+  web = True,
 )
 
 ts_config(

packages/kbn-i18n/BUILD.bazel

@@ -65,7 +65,7 @@ jsts_transpiler(
   name = "target_web",
   srcs = SRCS,
   build_pkg_name = package_name(),
-  config_file = ".babelrc.browser"
+  web = True,
 )
 
 ts_config(