Merge branch 'master' into event-log/query-support

* master: (44 commits)
  [Alerting] add alerting privileges for uptime and metrics (elastic#61113)
  Update percy agent to latest version (elastic#62089)
  [APM] Update central configuration text (elastic#61556)
  [Fleet] Ouput api key do not need metricbeat* access (elastic#60319)
  Document new `xpack.security.authc.*` settings and related 8.0.0 breaking changes. (elastic#61443)
  Migrate test plugins ⇒ NP (kbn_tp_sample_panel_action) (elastic#60749)
  [Alerting] Add "Start trial" button for connectors (elastic#61774)
  [ML] Transforms: Fix handling of default and advanced search on step summary view. (elastic#61799)
  [Task Manager] Change info message "ran out Available Workers" to debug (elastic#62083)
  [Maps] Highlight selected layer in TOC (elastic#61510)
  ensure pageIndex is set correclty in analytics list (elastic#62041)
  [ML] Functional API tests - fix mml request bodies (elastic#62116)
  Fix validation for index threshold when selecting an index (elastic#61615)
  [SIEM][Detection Engine] Adds release notes link and updates one UI section
  [backport] Bump to 5.1.2 (elastic#62117)
  [APM] .apm-agent-configuration is not created if Kibana is started while ES is not ready (elastic#61610)
  [Fleet] Enrollment list page (elastic#61346)
  [ML] Fix maximum default enabled columns for data grid. (elastic#62005)
  [Home][Tutorial] Add Oracle data UI (elastic#61595)
  [APM] Ensure telemetry data matches SO/telemetry mapping (elastic#61957)
  ...

.ci/Jenkinsfile_flaky

@@ -35,7 +35,7 @@ kibanaPipeline(timeoutMinutes: 180) {
             if (!IS_XPACK) {
               kibanaPipeline.buildOss()
               if (CI_GROUP == '1') {
-                runbld("./test/scripts/jenkins_build_kbn_tp_sample_panel_action.sh", "Build kbn tp sample panel action for ciGroup1")
+                runbld("./test/scripts/jenkins_build_kbn_sample_panel_action.sh", "Build kbn tp sample panel action for ciGroup1")
               }
             } else {
               kibanaPipeline.buildXpack()

docs/canvas/canvas-elements.asciidoc

@@ -23,7 +23,7 @@ By default, most of the elements you create use demo data until you change the d
 
 * *{es} SQL* — Access your data in {es} using SQL syntax. For information about SQL syntax, refer to {ref}/sql-spec.html[SQL language].
 
-* *{es} raw data* — Access your raw data in {es} without the use of aggregations. Use {es} raw data when you have low volume datasets, or to plot exact, non-aggregated values.
+* *{es} documents* &mdash; Access your data in {es} without using aggregations. To use, select an index and fields, and optionally enter a query using the <<lucene-query,Lucene Query Syntax>>. Use the *{es} documents* data source when you have low volume datasets, to view raw documents, or to plot exact, non-aggregated values on a chart.
 
 * *Timelion* &mdash; Access your time series data using <<timelion,Timelion>> queries. To use Timelion queries, you can enter a query using the <<lucene-query,Lucene Query Syntax>>.
 

docs/logs/using.asciidoc

@@ -38,7 +38,7 @@ Log entries for the specified time appear in the middle of the page. To quickly
 [[logs-customize]]
 === Customize your view
 Click *Customize* to customize the view.
-Here, you can set the scale to use for the minimap timeline, choose whether to wrap long lines, and choose your preferred text size.
+Here, you can choose whether to wrap long lines, and choose your preferred text size.
 
 [float]
 === Configuring the data to use for your logs

docs/migration/migrate_8_0.asciidoc

@@ -61,24 +61,53 @@ for example, `logstash-*`.
 *Impact:* Use `xpack.security.authc.providers` instead.
 
 [float]
-==== `xpack.security.authc.saml.realm` is now mandatory when using the SAML authentication provider
-*Details:* Previously Kibana was choosing the appropriate Elasticsearch SAML realm automatically using the `Assertion Consumer Service`
-URL that it derived from the actual server address. Starting in 8.0.0, the Elasticsearch SAML realm name that Kibana will use should be
-specified explicitly.
+==== `xpack.security.authc.providers` has changed value format
+*Details:* `xpack.security.authc.providers` setting in the `kibana.yml` has changed value format.
 
-*Impact:* Always define `xpack.security.authc.saml.realm` when using the SAML authentication provider.
+*Impact:* Array of provider types as a value is no longer supported, use extended object format instead.
+
+[float]
+==== `xpack.security.authc.saml` is no longer valid
+*Details:* The deprecated `xpack.security.authc.saml` setting in the `kibana.yml` file has been removed.
+
+*Impact:* Configure SAML authentication providers using `xpack.security.authc.providers.saml.{provider unique name}.*` settings instead.
+
+[float]
+==== `xpack.security.authc.oidc` is no longer valid
+*Details:* The deprecated `xpack.security.authc.oidc` setting in the `kibana.yml` file has been removed.
+
+*Impact:* Configure OpenID Connect authentication providers using `xpack.security.authc.providers.oidc.{provider unique name}.*` settings instead.
 
 [float]
 ==== `xpack.security.public` is no longer valid
-*Details:* The deprecated `xpack.security.public` setting in the `kibana.yml` file has been removed.
+*Details:* Previously Kibana was choosing the appropriate Elasticsearch SAML realm automatically using the `Assertion Consumer Service`
+URL that it derived from the actual server address and `xpack.security.public` setting. Starting in 8.0.0, the deprecated `xpack.security.public` setting in the `kibana.yml` file has been removed and the Elasticsearch SAML realm name that Kibana will use should be specified explicitly.
 
-*Impact:* Define `xpack.security.authc.saml.realm` when using the SAML authentication provider instead.
+*Impact:* Define `xpack.security.authc.providers.saml.{provider unique name}.realm` when using the SAML authentication providers instead.
 
 [float]
 ==== `/api/security/v1/saml` endpoint is no longer supported
 *Details:* The deprecated `/api/security/v1/saml` endpoint is no longer supported.
 
-*Impact:* Rely on `/api/security/saml/callback` endpoint when using SAML instead. This change should be reflected in Kibana `server.xsrf.whitelist` config as well as in Elasticsearch and Identity Provider SAML settings.
+*Impact:* Rely on `/api/security/saml/callback` endpoint when using SAML instead. This change should be reflected in Elasticsearch and Identity Provider SAML settings.
+
+[float]
+==== `/api/security/v1/oidc` endpoint is no longer supported
+*Details:* The deprecated `/api/security/v1/oidc` endpoint is no longer supported.
+
+*Impact:* Rely on `/api/security/oidc/callback` endpoint when using OpenID Connect instead. This change should be reflected in Elasticsearch and OpenID Connect Provider settings.
+
+[float]
+==== `/api/security/v1/oidc` endpoint is no longer supported for Third Party initiated login
+*Details:* The deprecated `/api/security/v1/oidc` endpoint is no longer supported for Third Party initiated login.
+
+*Impact:* Rely on `/api/security/oidc/initiate_login` endpoint when using Third Party initiated OpenID Connect login instead. This change should be reflected in Elasticsearch and OpenID Connect Provider settings.
+
+[float]
+==== `/api/security/v1/oidc/implicit` endpoint is no longer supported
+*Details:* The deprecated `/api/security/v1/oidc/implicit` endpoint is no longer supported.
+
+*Impact:* Rely on `/api/security/oidc/implicit` endpoint when using OpenID Connect Implicit Flow instead. This change should be reflected in OpenID Connect Provider settings.
 
 [float]
 === `optimize` directory is now in the `data` folder

docs/setup/settings.asciidoc

@@ -410,9 +410,7 @@ all http requests to https over the port configured as `server.port`.
 supported protocols with versions. Valid protocols: `TLSv1`, `TLSv1.1`, `TLSv1.2`
 
 `server.xsrf.whitelist:`:: It is not recommended to disable protections for
-arbitrary API endpoints. Instead, supply the `kbn-xsrf` header. There are some
-scenarios where whitelisting is required, however, such as
-<<kibana-authentication, SAML and OpenID Connect Single Sign-On setups>>.
+arbitrary API endpoints. Instead, supply the `kbn-xsrf` header.
 The `server.xsrf.whitelist` setting requires the following format:
 
 [source,text]