[Logs UI] Test cross-version Cross-Cluster Search scenarios

[jasonrhodes]

Based on the information we've received from the ES team about cross-version cross-cluster search, we expect there to be some amount of breakage in the Logs UI when users are searching across clusters where at least one of those clusters has log data but the version of ES in that cluster does not support the Fields API.

In support of this Kibana testing effort, we need to test a few scenarios and report back how the Logs UI performs in these version combinations.

AC:

• Report how logs are returned in the Logs UI for each of the following scenarios. In all cases, we should check what happens when the Logs UI is only trying to load data from the remote cluster, as well as when it's trying to load log data across both clusters.
  • ES 6.8 + ES/Kibana 7.11
  • ES 6.8 + ES/Kibana 7.12
  • ES 7.11 + ES/Kibana 7.12

Our expectation is that in the 6.8 -> 7.x scenarios, log data from the 6.8 cluster will not appear in the Logs UI, but the Logs UI will not crash or throw errors and it will continue to display the 7.x log data, even when queried alongside the 6.8 data.

In the 7.11/7.12 scenario, we expect things to work fine for both sets of data (but we need to confirm because the fields API apparently had some changes between 7.11 and 7.12).

Notes:

• Cross-cluster search documentation

[elasticmachine]

Pinging @elastic/logs-metrics-ui (Team:logs-metrics-ui)

[weltenwort]

Tested scenarios

• Log stream mixed data
• Log stream remote data
• Alerts mixed data
• Alerts remote data
• ML integration mixed data
• ML integration remote data

Outcomes

Summary

• Accessing indices in a 7.11.2 cluster from a 7.12.0 cluster works as expected.
• Accessing indices in a 6.8.15 cluster from either a 7.12.0 cluster or a 7.11.2 cluster fails in an identical way. Operations that only use aggregated data (such as the minimap histogram, the alerting queries or ML anomaly detections) work as expected.

7.12.0 to 7.11.2

• ✔️ Log stream mixed data
• ✔️ Log stream remote data
• ✔️ Alerts mixed data
• ✔️ Alerts remote data
• ✔️ ML integration mixed data
• ✔️ ML integration remote data

7.12.0 to 6.8.15

• ❌ Log stream mixed data
  • minimap works
  • no log entries shown
• ❌ Log stream remote data
  • minimap works
  • no log entries shown
• ✔️ Alerts mixed data
• ✔️ Alerts remote data
• ⚠️ ML integration mixed data
  • anomaly detection works
  • showing examples only works for local indices
• ⚠️ ML integration remote data
  • anomaly detection works
  • showing examples doesn't work

7.11.2 to 6.8.15

• ❌ Log stream mixed data
  • minimap works
  • no log entries shown
• ❌ Log stream remote data
  • minimap works
  • no log entries shown
• ✔️ Alerts mixed data
• ✔️ Alerts remote data
• ⚠️ ML integration mixed data
  • anomaly detection works
  • showing examples only works for local indices
• ⚠️ ML integration remote data
  • anomaly detection works
  • showing examples doesn't work

Example screenshot

[jasonrhodes]

Thank you, @weltenwort !

For reference, this bugfix: #94972 is slated for 7.12.1 and 7.13 -- in both of those versions we expect the "mixed data" scenarios above to show data for the local cluster (but to still be missing entries from the remote cluster). We'll have to confirm once those BCs are available.

[matschaffer]

cc @neiljbrookes

Awesome to see the testing. We'll use this to double down our efforts for consistent beats/ES versioning.