Merge branch '8.11' into backport/8.11/pr-167916

.buildkite/pull_requests.json

@@ -55,7 +55,7 @@
       "repoName": "kibana",
       "pipelineSlug": "kibana-kme-test",
 
-      "enabled": true,
+      "enabled": false,
       "allow_org_users": true,
       "allowed_repo_permissions": ["admin", "write"],
       "allowed_list": ["barlowm", "renovate[bot]"],

docs/apm/infrastructure.asciidoc

@@ -2,6 +2,8 @@
 [[infrastructure]]
 === Infrastructure
 
+beta::[]
+
 The *Infrastructure* tab provides information about the containers, pods, and hosts,
 that the selected service is linked to.
 

docs/apm/spans.asciidoc

@@ -43,8 +43,9 @@ For example, quickly view:
 [[distributed-tracing]]
 ==== Distributed tracing
 
-If your trace sample timeline is colorful, it's indicative of a distributed trace.
-Services in a distributed trace are separated by color and listed in the order they occur.
+When a trace travels through multiple services it is known as a _distributed trace_.
+In APM, the colors in a distributed trace represent different services and
+are listed in the order they occur.
 
 [role="screenshot"]
 image::apm/images/apm-services-trace.png[Example of distributed trace colors in the APM app in Kibana]

docs/apm/traces.asciidoc

@@ -17,6 +17,10 @@ it's the collective amount of pain a specific endpoint is causing your users.
 If there's a particular endpoint you're worried about, select it to view its
 <<transaction-details,transaction details>>.
 
+You can also use queries to filter and search the transactions shown on this page.
+Note that only properties available on root transactions are searchable.
+For example, you can't search for `label.tier: 'high'`, as that field is only available on non-root transactions.
+
 [role="screenshot"]
 image::apm/images/apm-traces.png[Example view of the Traces overview in APM app in Kibana]
 

docs/management/cases/add-connectors.asciidoc

@@ -1,10 +1,12 @@
 [[add-case-connectors]]
-== Add connectors
-
+== Add connectors to cases
 :frontmatter-description: Configure connectors to push case details to external incident management systems.
 :frontmatter-tags-products: [kibana]
 :frontmatter-tags-content-type: [how-to] 
 :frontmatter-tags-user-goals: [configure]
+++++
+<titleabbrev>Add connectors</titleabbrev>
+++++
 
 You can add connectors to cases to push information to these external incident
 management systems:
@@ -23,6 +25,11 @@ appropriate {kib} feature privileges. Refer to <<setup-cases>>.
 [[create-case-connectors]]
 == Create connectors
 
+:frontmatter-description: Open and track issues in {kib} cases. 
+:frontmatter-tags-products: [kibana]
+:frontmatter-tags-content-type: [overview] 
+:frontmatter-tags-user-goals: [analyze]
+
 You can create connectors in *{stack-manage-app} > {connectors-ui}*,
 as described in <<action-types>>. Alternatively, you can create them in
 *{stack-manage-app} > Cases*:
@@ -31,7 +38,7 @@ as described in <<action-types>>. Alternatively, you can create them in
 +
 --
 [role="screenshot"]
-image::images/cases-connectors.png[]
+image::images/cases-settings.png[View case settings]
 // NOTE: This is an autogenerated screenshot. Do not edit it directly.
 --
 

docs/management/cases/index.asciidoc

@@ -1,4 +1,4 @@
 include::cases.asciidoc[]
 include::setup-cases.asciidoc[leveloffset=+1]
 include::manage-cases.asciidoc[leveloffset=+1]
-include::add-connectors.asciidoc[leveloffset=+1]
+include::add-connectors.asciidoc[leveloffset=+1]

docs/management/cases/manage-cases.asciidoc

@@ -12,6 +12,12 @@
 Open a new case to keep track of issues and share their details with colleagues.
 
 . Go to *Management > {stack-manage-app} > Cases*, then click *Create case*.
++
+--
+[role="screenshot"]
+image::images/cases-create.png[Create a case in {stack-manage-app}]
+// NOTE: This is an autogenerated screenshot. Do not edit it directly.
+--
 
 . Give the case a name, severity, and description.
 +
@@ -22,11 +28,90 @@ text.
 . Optionally, add a category, assignees, and tags.
 You can add users only if they meet the necessary <<setup-cases,prerequisites>>.
 
-. For *External incident management system*, select a connector. For more
+. preview:[] If you defined any custom fields, they appear in the *Additional fields* section.
+Check out <<case-custom-fields>>.
+
+. For the *External incident management system*, select a connector. For more
 information, refer to <<add-case-connectors>>.
 
 . After you've completed all of the required fields, click *Create case*.
 
+[[case-custom-fields]]
+=== Add custom fields
+
+preview::[]
+
+You can add optional and required fields for customized case collaboration.
+
+. Go to *{stack-manage-app} > Cases* and click *Settings*.
++
+--
+[role="screenshot"]
+image::images/cases-custom-fields-view.png[View custom fields in case settings]
+// NOTE: This is an autogenerated screenshot. Do not edit it directly.
+
+NOTE: To view and change case settings, you must have the appropriate {kib} feature privileges. Refer to <<setup-cases>>.
+--
+
+. In the *Custom fields* section, click *Add field*.
++
+--
+[role="screenshot"]
+image::images/cases-custom-fields-add.png[Add a custom field in case settings]
+// NOTE: This is an autogenerated screenshot. Do not edit it directly.
+--
+
+. Enter a field label.
+
+. Choose a field type: text or toggle.
+
+. If you want the text field to be mandatory in all cases, select *Make this field required*.
+
+. Click *Save field*.
+
+You can subsequently remove or edit custom fields on the *Settings* page.
+
+After you create custom fields, they're added to all new and existing cases.
+
+Existing cases have null values for the new text fields until you set them in each case.
+For example, you must click the pencil icon next to `my-field` to set it:
+
+[role="screenshot"]
+image::images/cases-custom-fields.png[A case that has an unset custom field]
+// NOTE: This is an autogenerated screenshot. Do not edit it directly.
+
+[[add-case-notifications]]
+=== Add email notifications
+
+You can configure email notifications that occur when users are assigned to
+cases.
+
+For hosted {kib} on {ess}:
+
+. Add the email domains to the {cloud}/ec-organizations-notifications-domain-allowlist.html[notifications domain allowlist].
++
+--
+You do not need to take any more steps to configure an email connector or update
+{kib} user settings, since the preconfigured Elastic-Cloud-SMTP connector is
+used by default.
+--
+
+For self-managed {kib}:
+
+. Create a preconfigured email connector.
++
+--
+NOTE: At this time, email notifications support only preconfigured connectors,
+which are defined in the `kibana.yml` file.
+For examples, refer to <<preconfigured-email-configuration>> and <<configuring-email>>.
+--
+. Set the `notifications.connectors.default.email` {kib} setting to the name of
+your email connector.
+. If you want the email notifications to contain links back to the case, you
+must configure the <<server-publicBaseUrl,server.publicBaseUrl>> setting.
+
+When you subsequently add assignees to cases, they receive an email.
+
 [[add-case-files]]
 === Add files
 
@@ -48,7 +133,7 @@ When you export cases as <<managing-saved-objects,saved objects>>, the case file
 ============================================================================
 
 [[add-case-visualization]]
-=== Add a visualization
+=== Add visualizations
 
 You can also optionally add visualizations.
 For example, you can portray event and alert data through charts and graphs.
@@ -79,40 +164,6 @@ Alternatively, while viewing a <<dashboard,dashboard>> you can open a panel's me
 
 After a visualization has been added to a case, you can modify or interact with it by clicking the *Open Visualization* option in the case's comment menu.
 
-[[add-case-notifications]]
-=== Add email notifications
-
-// tag::case-notifications[]
-You can configure email notifications that occur when users are assigned to
-cases.
-
-For hosted {kib} on {ess}:
-
-. Add the email domains to the {cloud}/ec-organizations-notifications-domain-allowlist.html[notifications domain allowlist].
-+
---
-You do not need to take any more steps to configure an email connector or update
-{kib} user settings, since the preconfigured Elastic-Cloud-SMTP connector is
-used by default.
---
-
-For self-managed {kib}:
-
-. Create a preconfigured email connector.
-+
---
-NOTE: At this time, email notifications support only preconfigured connectors,
-which are defined in the `kibana.yml` file.
-For examples, refer to <<preconfigured-email-configuration>> and <<configuring-email>>.
---
-. Set the `notifications.connectors.default.email` {kib} setting to the name of
-your email connector.
-. If you want the email notifications to contain links back to the case, you
-must configure the <<server-publicBaseUrl,server.publicBaseUrl>> setting.
-
-When you subsequently add assignees to cases, they receive an email.
-// end::case-notifications[]
-
 [[manage-case]]
 === Manage cases
 

docs/management/cases/setup-cases.asciidoc

@@ -13,7 +13,7 @@ privileges:
 |=== 
 
 | Action | {kib} privileges
-| Give full access to manage cases 
+| Give full access to manage cases and settings
 a|
 * `All` for the *Cases* feature under *Management*.
 * `All` for the *{connectors-feature}* feature under *Management*.

docs/management/connectors/action-types/bedrock.asciidoc

@@ -18,8 +18,8 @@ The {bedrock} connector uses https://github.com/axios/axios[axios] to send a POS
 You can create connectors in *{stack-manage-app} > {connectors-ui}*.  For example:
 
 [role="screenshot"]
-// TODO: need logo before screenshot
 image::management/connectors/images/bedrock-connector.png[{bedrock} connector]
+// NOTE: This is an autogenerated screenshot. Do not edit it directly.
 
 [float]
 [[bedrock-connector-configuration]]
@@ -41,8 +41,8 @@ You can test connectors with the <<execute-connector-api,run connector API>> or
 as you're creating or editing the connector in {kib}. For example:
 
 [role="screenshot"]
-// TODO: need logo before screenshot
 image::management/connectors/images/bedrock-params.png[{bedrock} params test]
+// NOTE: This is an autogenerated screenshot. Do not edit it directly.
 
 The {bedrock} actions have the following configuration properties.
 

docs/setup/docker.asciidoc

@@ -10,7 +10,7 @@
 :es-docker-image:     {es-docker-repo}:{version}
 
 Docker images for {kib} are available from the Elastic Docker registry. The
-base image is https://hub.docker.com/_/ubuntu[ubuntu:20.04].
+base image is https://hub.docker.com/_/ubuntu[ubuntu:22.04].
 
 A list of all published Docker images and tags is available at
 https://www.docker.elastic.co[www.docker.elastic.co]. The source code is in

package.json

@@ -1091,7 +1091,7 @@
     "@babel/preset-react": "^7.18.6",
     "@babel/preset-typescript": "^7.21.0",
     "@babel/register": "^7.21.0",
-    "@babel/traverse": "^7.21.2",
+    "@babel/traverse": "^7.23.2",
     "@babel/types": "^7.21.2",
     "@bazel/ibazel": "^0.16.2",
     "@bazel/typescript": "4.6.2",

packages/kbn-es-query/src/es_query/es_aggregate_query.test.ts

@@ -101,6 +101,18 @@ describe('sql query helpers', () => {
 
       const idxPattern5 = getIndexPatternFromESQLQuery('from foo | limit 2');
       expect(idxPattern5).toBe('foo');
+
+      const idxPattern6 = getIndexPatternFromESQLQuery('from foo-1,foo-2 | limit 2');
+      expect(idxPattern6).toBe('foo-1,foo-2');
+
+      const idxPattern7 = getIndexPatternFromESQLQuery('from foo-1, foo-2 | limit 2');
+      expect(idxPattern7).toBe('foo-1, foo-2');
+
+      const idxPattern8 = getIndexPatternFromESQLQuery('FROM foo-1,  foo-2');
+      expect(idxPattern8).toBe('foo-1,  foo-2');
+
+      const idxPattern9 = getIndexPatternFromESQLQuery('FROM foo-1, foo-2 [metadata _id]');
+      expect(idxPattern9).toBe('foo-1, foo-2');
     });
   });
 });

packages/kbn-es-query/src/es_query/es_aggregate_query.ts

@@ -59,10 +59,10 @@ export function getIndexPatternFromESQLQuery(esql?: string): string {
   }
   const parsedString = esql?.replaceAll('`', '');
   // case insensitive match for the index pattern
-  const regex = new RegExp(/FROM\s+([\w*-.!@$^()~;]+)/, 'i');
+  const regex = new RegExp(/FROM\s+([\w*-.!@$^()~;\s]+)/, 'i');
   const matches = parsedString?.match(regex);
   if (matches) {
-    return matches[1];
+    return matches[1]?.trim();
   }
   return '';
 }

src/core/server/integration_tests/saved_objects/migrations/group3/actions/actions.test.ts

@@ -5,7 +5,6 @@
  * in compliance with, at your election, the Elastic License 2.0 or the Server
  * Side Public License, v 1.
  */
-
 import { createTestServers } from '@kbn/core-test-helpers-kbn-server';
 import { MIGRATION_CLIENT_OPTIONS } from '@kbn/core-saved-objects-migration-server-internal';
 import { runActionTestSuite } from './actions_test_suite';