Merge branch 'main' into refactor/security-flyout-modal-cases-alert

.buildkite/scripts/bootstrap.sh

@@ -26,6 +26,8 @@ fi
 ### upload ts-refs-cache artifacts as quickly as possible so they are available for download
 ###
 if [[ "${BUILD_TS_REFS_CACHE_CAPTURE:-}" == "true" ]]; then
+  echo "--- Build ts-refs-cache"
+  node scripts/build_ts_refs.js --ignore-type-failures
   echo "--- Upload ts-refs-cache"
   cd "$KIBANA_DIR/target/ts_refs_cache"
   gsutil cp "*.zip" 'gs://kibana-ci-ts-refs-cache/'

.github/CODEOWNERS

@@ -56,8 +56,6 @@
 /examples/state_containers_examples/ @elastic/kibana-app-services
 /examples/ui_action_examples/ @elastic/kibana-app-services
 /examples/ui_actions_explorer/ @elastic/kibana-app-services
-/examples/url_generators_examples/ @elastic/kibana-app-services
-/examples/url_generators_explorer/ @elastic/kibana-app-services
 /examples/field_formats_example/ @elastic/kibana-app-services
 /examples/partial_results_example/ @elastic/kibana-app-services
 /examples/search_examples/ @elastic/kibana-app-services
@@ -344,8 +342,8 @@
 /x-pack/plugins/triggers_actions_ui/ @elastic/response-ops
 /x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/ @elastic/response-ops
 /x-pack/test/functional_with_es_ssl/fixtures/plugins/alerts/ @elastic/response-ops
-/docs/user/alerting/ @elastic/response-ops
-/docs/management/connectors/ @elastic/response-ops
+/docs/user/alerting/ @elastic/response-ops @elastic/mlr-docs
+/docs/management/connectors/ @elastic/response-ops @elastic/mlr-docs
 #CC# /x-pack/plugins/stack_alerts @elastic/response-ops
 /x-pack/plugins/cases/ @elastic/response-ops
 /x-pack/test/cases_api_integration/ @elastic/response-ops

.github/workflows/label-qa-fixed-in.yml

@@ -37,7 +37,8 @@ jobs:
               }
             }
           prnumber: ${{ github.event.number }}
-          token: ${{ secrets.FLEET_TECH_KIBANA_USER_TOKEN }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.FLEET_TECH_KIBANA_USER_TOKEN }}
       - uses: sergeysova/jq-action@v2
         id: issues_to_label
         with:
@@ -75,4 +76,5 @@ jobs:
             }
           issueid: ${{ matrix.issueNodeId }}
           labelids: ${{ needs.fetch_issues_to_label.outputs.label_ids }}
-          token: ${{ secrets.FLEET_TECH_KIBANA_USER_TOKEN }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.FLEET_TECH_KIBANA_USER_TOKEN }}

dev_docs/key_concepts/building_blocks.mdx

@@ -124,7 +124,7 @@ sharing and space isolation, and tags.
 
 ## Advanced Settings
 
-<DocLink id="kibDevTutorialAdvancedSettings" text="Advanced Settings and the uiSettings service /> should be used if you need to add application-level configuration options. If you wanted to add a setting for listing a number of items per page in your TODO application, then `pageListing` would be a configuration option.
+<DocLink id="kibDevTutorialAdvancedSettings" text="Advanced Settings and the uiSettings service" /> should be used if you need to add application-level configuration options. If you wanted to add a setting for listing a number of items per page in your TODO application, then `pageListing` would be a configuration option.
 
 **Github labels**: `Team:Core`, `Feature:uiSettings`, `Feature:Advanced Settings`
 

dev_docs/tutorials/ci.mdx

@@ -0,0 +1,48 @@
+---
+id: kibDevTutorialCI
+slug: /kibana-dev-docs/tutorials/ci
+title: CI
+summary: CI
+date: 2022-02-03
+tags: ['kibana', 'onboarding', 'dev', 'ci']
+---
+
+## CI
+
+Kibana uses BuildKite to run a series of checks against each pull requests and tracked branch.  Results are posted in pull requests as comments and from the BuildKite UI
+
+### Comments
+
+Comments in pull requests can be used to trigger CI operations.
+
+#### `buildkite test this`
+
+Run test suites and checks.
+
+#### `@elasticmachine merge upstream`
+
+Merge in the most recent changes from upstream.
+
+#### `@elasticmachine run elasticsearch-ci/docs`
+
+Build documentation from the root `docs` folder.
+
+### Labels
+
+Labels can be added to a pull request to run conditional pipelines.
+
+#### `ci:deploy-cloud`
+
+Deploy a pull request to Elastic Cloud.  Deployment information will be available as an annotation at the top of a build.  Access credentials will be available in vault.
+
+#### `ci:build-all-platforms`
+
+Build Windows, macOS, and Linux archives.  Artifacts will be available on the "Artifacts" tab of the "Build Kibana Distribution and Plugins" step.
+
+#### `ci:build-os-packages`
+
+Build Docker images, and Debian and RPM packages.  Artifacts will be available on the "Artifacts" tab of the "Build Kibana Distribution and Plugins" step.
+
+#### `ci:all-cypress-suites`
+
+By default, Cypress test suites are only run when code changes are made in certain files, typically files with overlapping test coverage.  Adding this label will cause all Cypress tests to run.

docs/apm/correlations.asciidoc

@@ -60,8 +60,6 @@ filtered out, you can begin viewing sample traces to continue your investigation
 [[correlations-error-rate]]
 ==== Find failed transaction correlations
 
-beta::[]
-
 The correlations on the *Failed transaction correlations* tab help you discover
 which attributes are most influential in distinguishing between transaction
 failures and successes. In this context, the success or failure of a transaction

docs/concepts/data-views.asciidoc

@@ -32,16 +32,16 @@ uploaded a file, or added sample data,
 you get a data view for free, and can start exploring your data.
 If you loaded your own data, follow these steps to create a data view.
 
-. Open the main menu, then click to *Stack Management > Data Views*.
+. Open the main menu, then click *Stack Management > Data Views*.
 
 . Click *Create data view*.
 
-[role="screenshot"]
-image:management/index-patterns/images/create-data-view.png["Create data view"]
-
 . Start typing in the *name* field, and {kib} looks for the names of
 indices, data streams, and aliases that match your input.
 +
+[role="screenshot"]
+image:management/index-patterns/images/create-data-view.png["Create data view"]
++
 ** To match multiple sources, use a wildcard (*). For example, `filebeat-*` matches
 `filebeat-apache-a`, `filebeat-apache-b`, and so on.
 +

docs/concepts/kuery.asciidoc

@@ -144,6 +144,20 @@ but in some cases you might need to search on dates. Include the date range in q
 @timestamp < "2021"
 -------------------
 
+KQL supports date math expressions.
+
+[source,yaml]
+-------------------
+@timestamp < now-1d
+-------------------
+
+[source,yaml]
+-------------------
+updated_at > 2022-02-17||+1M/d
+-------------------
+
+Check the
+{ref}/common-options.html#date-math[date math documentation] for more examples.
 
 [discrete]
 === Exist queries

docs/discover/document-explorer.asciidoc

@@ -31,6 +31,18 @@ To resize a column, drag the right edge of the column header until the column is
 
 Column widths are stored with a saved search.  When you visualize saved searches on dashboards, the saved search appears the same as in **Discover**.
 
+[float]
+[[document-explorer-row-height]]
+=== Adjust row height
+
+To set the row height to 1 or more lines, or automatically
+adjust the height to fit the contents, click the row height icon
+image:images/row-height-icon.png[icon to open the Row height pop-up].
+
+[role="screenshot"]
+image::images/document-explorer-row-height.png[Row height settings for Document Explroer, width="75%"]
+
+
 [float]
 [[document-explorer-sort-data]]
 === Sort data
@@ -43,7 +55,7 @@ The default sort is based on the time field, from new to old.
 [role="screenshot"]
 image::images/document-explorer-sort-data.png[Pop-up in Document Explorer for sorting columns, width="75%"]
 
-. To add more fields to the sort, expand the dropdown menu.
+. To add more fields to the sort, select from the dropdown menu.
 +
 By default, columns are sorted in the order they are added.
 For example, to sort by `order_date` then `geo.country_iso_code`, make sure `order_date` appears first.
@@ -77,14 +89,22 @@ the documents that occurred before and after it.
 image:images/expand-icon-2.png[double arrow icon to open a flyout with the document details].
 +
 [role="screenshot"]
-image::images/document-explorer-expand.png[Multi field sort in Document Explorer]
+image::images/document-explorer-expand.png[Expanded view in Document Explorer]
 
-. Scan through the fields and their values. If you find a field of interest,
+. Scan through the fields and their values, or search for a field by name.
+
+. When you find a field of interest,
 click
-image:images/actions-icon.png[three dots icon in table column] in the *Actions* column for filters and other controls.
-. To view documents that occurred before or after the event you are looking at, click <<discover-view-surrounding-documents,**Surrounding documents**>>.
+image:images/actions-icon.png[three dots icon in table column] in the *Actions* column
+to:
+.. Filter the view of the data
+.. Toggle the field in or out the document table
+.. Pin the field so it stays at the top
+
 . For direct access to a particular document, click <<discover-view-single-document,**Single document**>>.
 
+. To view documents that occurred before or after the event you are looking at, click <<discover-view-surrounding-documents,**Surrounding documents**>>.
+
 [float]
 [[document-explorer-full-screen]]
 === View documents in fullscreen

docs/discover/field-statistics.asciidoc

@@ -14,11 +14,9 @@ for the data and its cardinality?
 This example explores the fields in
 the <<gs-get-data-into-kibana, sample web logs data>>, or you can use your own data.
 
-. Open the main menu, click *Stack Managment > Advanced Settings*, search for *Show field statistics*,
-and turn on the setting.
+. Open the main menu, and click *Discover*.
 
-. Open the main menu, click *Discover*, expand the {data-source} dropdown,
-and select *kibana_sample_data_logs*.
+. Expand the {data-source} dropdown, and select *kibana_sample_data_logs*.
 
 . If you don’t see any results, expand the time range, for example, to *Last 7 days*.
 

docs/discover/save-search.asciidoc

@@ -7,10 +7,10 @@ Saved searches are good for adding search results to a dashboard,
 and can also serve as a foundation for building visualizations.
 
 A saved search stores the query text, filters, and
-current view of *Discover*—the columns selected in the document table,
+current view of *Discover*, including the columns selected in the document table,
 the sort order, and the {data-source}.
 Saved searches are different from <<save-load-delete-query,saved queries>>, which
-are primarily used for storing query text and are available in any app with a query bar.
+are for storing query text and are available in any app with a query bar.
 
 [role="xpack"]
 [[discover-read-only-access]]

docs/discover/view-document.asciidoc

@@ -33,16 +33,11 @@ your {data-source} must contain time-based events.
 . In the expanded view, click **View surrounding documents**.
 +
 Documents are displayed using the same set of columns as the *Discover* view from which
-the context was opened. The anchor document is highlighted in blue.
-+
-[role="screenshot"]
-image::images/discover-context.png[Image showing context view feature, with anchor documents highlighted in blue]
-+
-The filters you applied in *Discover* are carried over to the context view. Pinned
+the context was opened. The filters you applied are also carried over. Pinned
 filters remain active, while normal filters are copied in a disabled state.
 +
 [role="screenshot"]
-image::images/discover-context-filters-inactive.png[Filter in context view]
+image::images/discover-context.png[Image showing context view feature, with anchor documents highlighted in blue]
 
 . To find the documents of interest, add filters.
 

docs/user/discover.asciidoc

@@ -8,7 +8,7 @@ What pages on your website contain a
 specific word or phrase? What events were logged most recently?
 What processes take longer than 500 milliseconds to respond?
 
-With *Discover*, you can quickly gain insight to your data: search and filter your data, get information
+With *Discover*, you can quickly search and filter your data, get information
 about the structure of the fields, and display your findings in a visualization.
 You can also customize and save your searches and place them on a dashboard.
 
@@ -19,7 +19,7 @@ image::images/discover.png[A view of the Discover app]
 [float]
 === Explore and query your data
 
-This tutorial shows you how to use *Discover* to quickly search large amounts of
+This tutorial shows you how to use *Discover* to search large amounts of
 data and understand what’s going on at any given time.
 
 You’ll learn to:
@@ -58,6 +58,10 @@ To view the ecommerce sample data, make sure the {data-source} is set to **kiban
 +
 [role="screenshot"]
 image::images/discover-data-view.png[How to set the {data-source} in Discover, width=50%]
++
+To create a data view for your own data,
+click the ellipsis icon (…​), and then click *Create new data view*.
+For details, refer to <<data-views, Create a data view.>>
 
 . Adjust the <<set-time-filter,time range>> to view data for the *Last 7 days*.
 +
@@ -73,8 +77,8 @@ click and drag the mouse over the chart.
 === Explore the fields in your data
 
 **Discover** includes a table that shows all the documents that match your search.
-By default, the table includes columns for the time field and the document `_source`,
-which can be overwhelming. You’ll modify this table to display only your fields of interest.
+By default, the table includes columns for the time field and the document `_source`.
+You’ll modify this table to display your fields of interest.
 
 . Scan through the list of **Available fields** until you find the `manufacturer` field.
 You can also search for the field by name.
@@ -110,7 +114,7 @@ You can add a runtime field to your {data-source} from inside of **Discover**,
 and then use that field for analysis and visualizations,
 the same way you do with other fields.
 
-. Click the ellipsis icon (...), and then click *Add field to data view*.
+. Click the ellipsis icon (...), and then click *Add field*.
 +
 [role="screenshot"]
 image:images/add-field-to-data-view.png[Dropdown menu located next to {data-source} field with item for adding a field to a {data-source}, width=50%]
@@ -168,17 +172,19 @@ you can use to build a structured query.
 Search the ecommerce data for documents where the country matches US:
 
 . Enter `g`, and then select *geoip.country_iso_code*.
-. Select *equals some value* and *US*, and then click *Update*.
+. Select *:* for equals some value and *US*, and then click *Update*.
 . For a more complex search, try:
 +
-`geoip.country_iso_code : US and products.taxless_price >= 75`
+```ts
+geoip.country_iso_code : US and products.taxless_price >= 75
+```
 
 [float]
 [[filter-in-discover]]
 === Filter your data
 
 Whereas the query defines the set of documents you are interested in,
-filters enable you to zero in on different subsets of those documents.
+filters enable you to zero in on subsets of those documents.
 You can filter results to include or exclude specific fields, filter for a value in a range,
 and more.
 
@@ -224,7 +230,7 @@ You can bookmark this document and share the link.
 
 Save your search so you can repeat it later, generate a CSV report, or use it in visualizations, dashboards, and Canvas workpads.
 Saving a search saves the query text, filters,
-and current view of *Discover*&mdash;the columns selected in the document table, the sort order, and the {data-source}.
+and current view of *Discover*, including the columns selected in the document table, the sort order, and the {data-source}.
 
 . In the toolbar, click **Save**.
 
@@ -287,4 +293,3 @@ include::{kib-repo-dir}/discover/search-sessions.asciidoc[]
 include::{kib-repo-dir}/discover/document-explorer.asciidoc[]
 
 include::{kib-repo-dir}/discover/field-statistics.asciidoc[]
-

nav-kibana-dev.docnav.json

@@ -46,6 +46,7 @@
           "id": "kibDevTutorialBuildingDistributable",
           "label": "Building a Kibana distributable"
         },
+        { "id": "kibDevTutorialCI" },
         { "id": "kibDevTutorialServerEndpoint" },
         { "id": "kibDevTutorialAdvancedSettings"}
       ]

packages/kbn-monaco/src/painless/antlr/painless_lexer.g4

@@ -17,6 +17,7 @@ LBRACE:    '[';
 RBRACE:    ']';
 LP:        '(';
 RP:        ')';
+DOLLAR:    '$';
 // We switch modes after a dot to ensure there are not conflicts
 // between shortcuts and decimal values.  Without the mode switch
 // shortcuts such as id.0.0 will fail because 0.0 will be interpreted