Merge remote-tracking branch 'upstream/master' into kbn-62016-createh…

…ref-basepath

x-pack/legacy/plugins/apm/public/components/app/ServiceMap/Cytoscape.stories.tsx

@@ -75,27 +75,17 @@ storiesOf('app/ServiceMap/Cytoscape', module)
       const cy = cytoscape();
       const elements = [
         { data: { id: 'default' } },
-        { data: { id: 'cache', label: 'cache', 'span.type': 'cache' } },
-        { data: { id: 'database', label: 'database', 'span.type': 'db' } },
+        { data: { id: 'cache', 'span.type': 'cache' } },
+        { data: { id: 'database', 'span.type': 'db' } },
         {
           data: {
             id: 'elasticsearch',
-            label: 'elasticsearch',
             'span.type': 'db',
             'span.subtype': 'elasticsearch'
           }
         },
-        {
-          data: { id: 'external', label: 'external', 'span.type': 'external' }
-        },
-        {
-          data: {
-            id: 'messaging',
-            label: 'messaging',
-            'span.type': 'messaging'
-          }
-        },
-
+        { data: { id: 'external', 'span.type': 'external' } },
+        { data: { id: 'messaging', 'span.type': 'messaging' } },
         {
           data: {
             id: 'dotnet',
@@ -119,11 +109,18 @@ storiesOf('app/ServiceMap/Cytoscape', module)
         },
         {
           data: {
-            id: 'js-base',
-            'service.name': 'js-base service',
+            id: 'RUM (js-base)',
+            'service.name': 'RUM service',
             'agent.name': 'js-base'
           }
         },
+        {
+          data: {
+            id: 'RUM (rum-js)',
+            'service.name': 'RUM service',
+            'agent.name': 'rum-js'
+          }
+        },
         {
           data: {
             id: 'nodejs',
@@ -163,7 +160,8 @@ storiesOf('app/ServiceMap/Cytoscape', module)
                 description={
                   <pre>
                     agent.name: {node.data('agent.name') || 'undefined'},
-                    span.type: {node.data('span.type') || 'undefined'}
+                    span.type: {node.data('span.type') || 'undefined'},
+                    span.subtype: {node.data('span.subtype') || 'undefined'}
                   </pre>
                 }
                 icon={
@@ -174,7 +172,7 @@ storiesOf('app/ServiceMap/Cytoscape', module)
                     width={80}
                   />
                 }
-                title={node.data('label')}
+                title={node.data('id')}
               />
             </EuiFlexItem>
           ))}

x-pack/legacy/plugins/apm/public/components/app/ServiceMap/Cytoscape.tsx

@@ -124,6 +124,12 @@ export function Cytoscape({
   // Trigger a custom "data" event when data changes
   useEffect(() => {
     if (cy && elements.length > 0) {
+      const renderedElements = cy.elements('node,edge');
+      const latestElementIds = elements.map(el => el.data.id);
+      const absentElements = renderedElements.filter(
+        el => !latestElementIds.includes(el.id())
+      );
+      cy.remove(absentElements);
       cy.add(elements);
       cy.trigger('data');
     }

x-pack/legacy/plugins/apm/public/components/app/ServiceMap/cytoscapeOptions.ts

@@ -83,7 +83,7 @@ const style: cytoscape.Stylesheet[] = [
     style: {
       'curve-style': 'taxi',
       // @ts-ignore
-      'taxi-direction': 'rightward',
+      'taxi-direction': 'auto',
       'line-color': lineColor,
       'overlay-opacity': 0,
       'target-arrow-color': lineColor,

x-pack/legacy/plugins/apm/public/components/app/ServiceMap/icons.ts

@@ -5,11 +5,12 @@
  */
 
 import cytoscape from 'cytoscape';
+import { isRumAgentName } from '../../../../../../../plugins/apm/common/agent_name';
 import {
   AGENT_NAME,
   SERVICE_NAME,
-  SPAN_TYPE,
-  SPAN_SUBTYPE
+  SPAN_SUBTYPE,
+  SPAN_TYPE
 } from '../../../../../../../plugins/apm/common/elasticsearch_fieldnames';
 import databaseIcon from './icons/database.svg';
 import defaultIconImport from './icons/default.svg';
@@ -62,7 +63,12 @@ export function iconForNode(node: cytoscape.NodeSingular) {
   const type = node.data(SPAN_TYPE);
 
   if (node.data(SERVICE_NAME)) {
-    return serviceIcons[node.data(AGENT_NAME) as string];
+    const agentName = node.data(AGENT_NAME);
+    // RUM can have multiple names. Normalize it
+    const normalizedAgentName = isRumAgentName(agentName)
+      ? 'js-base'
+      : agentName;
+    return serviceIcons[normalizedAgentName];
   } else if (isIE11) {
     return defaultIcon;
   } else if (

x-pack/legacy/plugins/apm/public/components/shared/ErrorRateAlertTrigger/index.tsx

@@ -6,6 +6,7 @@
 import React from 'react';
 import { EuiFieldNumber } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
+import { isFinite } from 'lodash';
 import { ForLastExpression } from '../../../../../../../plugins/triggers_actions_ui/public';
 import { ALERT_TYPES_CONFIG } from '../../../../../../../plugins/apm/common/alert_types';
 import { ServiceAlertTrigger } from '../ServiceAlertTrigger';
@@ -37,15 +38,17 @@ export function ErrorRateAlertTrigger(props: Props) {
     ...alertParams
   };
 
+  const threshold = isFinite(params.threshold) ? params.threshold : '';
+
   const fields = [
     <PopoverExpression
       title={i18n.translate('xpack.apm.errorRateAlertTrigger.isAbove', {
         defaultMessage: 'is above'
       })}
-      value={params.threshold.toString()}
+      value={threshold.toString()}
     >
       <EuiFieldNumber
-        value={alertParams.threshold ?? ''}
+        value={threshold}
         step={0}
         onChange={e =>
           setAlertParams('threshold', parseInt(e.target.value, 10))

x-pack/legacy/plugins/siem/server/lib/index_fields/elasticsearch_adapter.test.ts

@@ -23,77 +23,108 @@ describe('Index Fields', () => {
       ).toEqual(
         sortBy('name', [
           {
-            aggregatable: true,
-            category: 'base',
             description:
-              'Date/time when the event originated. For log events this is the date/time when the event was generated, and not when it was read. Required field for all events.',
+              'Date/time when the event originated.\n\nThis is the date/time extracted from the event, typically representing when\nthe event was generated by the source.\n\nIf the event source has no original timestamp, this value is typically populated\nby the first time the event was received by the pipeline.\n\nRequired field for all events.',
             example: '2016-05-23T08:05:34.853Z',
-            indexes: ['auditbeat', 'filebeat', 'packetbeat'],
             name: '@timestamp',
-            searchable: true,
             type: 'date',
+            searchable: true,
+            aggregatable: true,
+            category: 'base',
+            indexes: ['auditbeat', 'filebeat', 'packetbeat'],
           },
           {
+            description: 'Each document has an _id that uniquely identifies it',
+            example: 'Y-6TfmcB0WOhS6qyMv3s',
+            footnote: '',
+            group: 1,
+            level: 'core',
+            name: '_id',
+            required: true,
+            type: 'string',
+            searchable: true,
+            aggregatable: false,
+            readFromDocValues: true,
+            category: '_id',
+            indexes: ['auditbeat', 'filebeat', 'packetbeat'],
+          },
+          {
+            description:
+              'An index is like a ‘database’ in a relational database. It has a mapping which defines multiple types. An index is a logical namespace which maps to one or more primary shards and can have zero or more replica shards.',
+            example: 'auditbeat-8.0.0-2019.02.19-000001',
+            footnote: '',
+            group: 1,
+            level: 'core',
+            name: '_index',
+            required: true,
+            type: 'string',
+            searchable: true,
             aggregatable: true,
-            category: 'agent',
+            readFromDocValues: true,
+            category: '_index',
+            indexes: ['auditbeat', 'filebeat', 'packetbeat'],
+          },
+          {
             description:
-              'Ephemeral identifier of this agent (if one exists). This id normally changes across restarts, but `agent.id` does not.',
+              'Ephemeral identifier of this agent (if one exists).\n\nThis id normally changes across restarts, but `agent.id` does not.',
             example: '8a4f500f',
-            indexes: ['auditbeat'],
             name: 'agent.ephemeral_id',
-            searchable: true,
             type: 'string',
-          },
-          {
+            searchable: true,
             aggregatable: true,
             category: 'agent',
-            indexes: ['filebeat'],
+            indexes: ['auditbeat'],
+          },
+          {
             name: 'agent.hostname',
             searchable: true,
             type: 'string',
-          },
-          {
             aggregatable: true,
             category: 'agent',
+            indexes: ['filebeat'],
+          },
+          {
             description:
-              'Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id.',
+              'Unique identifier of this agent (if one exists).\n\nExample: For Beats this would be beat.id.',
             example: '8a4f500d',
-            indexes: ['packetbeat'],
             name: 'agent.id',
-            searchable: true,
             type: 'string',
-          },
-          {
+            searchable: true,
             aggregatable: true,
             category: 'agent',
+            indexes: ['packetbeat'],
+          },
+          {
             description:
-              'Name of the agent. This is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from. If no name is given, the name is often left empty.',
+              'Custom name of the agent.\n\nThis is a name that can be given to an agent. This can be helpful if for example\ntwo Filebeat instances are running on the same host but a human readable separation\nis needed on which Filebeat instance data is coming from.\n\nIf no name is given, the name is often left empty.',
             example: 'foo',
-            indexes: ['auditbeat', 'filebeat'],
             name: 'agent.name',
-            searchable: true,
             type: 'string',
-          },
-          {
+            searchable: true,
             aggregatable: true,
             category: 'agent',
+            indexes: ['auditbeat', 'filebeat'],
+          },
+          {
             description:
-              'Type of the agent. The agent type stays always the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.',
+              'Type of the agent.\n\nThe agent type stays always the same and should be given by the agent used.\nIn case of Filebeat the agent would always be Filebeat also if two Filebeat\ninstances are run on the same machine.',
             example: 'filebeat',
-            indexes: ['auditbeat', 'packetbeat'],
             name: 'agent.type',
-            searchable: true,
             type: 'string',
-          },
-          {
+            searchable: true,
             aggregatable: true,
             category: 'agent',
+            indexes: ['auditbeat', 'packetbeat'],
+          },
+          {
             description: 'Version of the agent.',
             example: '6.0.0-rc2',
-            indexes: ['auditbeat', 'filebeat'],
             name: 'agent.version',
-            searchable: true,
             type: 'string',
+            searchable: true,
+            aggregatable: true,
+            category: 'agent',
+            indexes: ['auditbeat', 'filebeat'],
           },
         ])
       );

x-pack/legacy/plugins/siem/server/lib/index_fields/elasticsearch_adapter.ts

@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { get } from 'lodash/fp';
+import { isEmpty, get } from 'lodash/fp';
 
 import { IndexField } from '../../graphql/types';
 import {
@@ -51,6 +51,23 @@ export class ElasticsearchIndexFieldAdapter implements FieldsAdapter {
   }
 }
 
+const missingFields = [
+  {
+    name: '_id',
+    type: 'string',
+    searchable: true,
+    aggregatable: false,
+    readFromDocValues: true,
+  },
+  {
+    name: '_index',
+    type: 'string',
+    searchable: true,
+    aggregatable: true,
+    readFromDocValues: true,
+  },
+];
+
 export const formatIndexFields = (
   responsesIndexFields: IndexFieldDescriptor[][],
   indexesAlias: IndexAlias[]
@@ -59,20 +76,23 @@ export const formatIndexFields = (
     .reduce(
       (accumulator: IndexField[], indexFields: IndexFieldDescriptor[], indexesAliasIdx: number) => [
         ...accumulator,
-        ...indexFields.reduce((itemAccumulator: IndexField[], index: IndexFieldDescriptor) => {
-          const alias: IndexAlias = indexesAlias[indexesAliasIdx];
-          const splitName = index.name.split('.');
-          const category = baseCategoryFields.includes(splitName[0]) ? 'base' : splitName[0];
-          return [
-            ...itemAccumulator,
-            {
-              ...(hasDocumentation(alias, index.name) ? getDocumentation(alias, index.name) : {}),
-              ...index,
-              category,
-              indexes: [alias],
-            } as IndexField,
-          ];
-        }, []),
+        ...[...missingFields, ...indexFields].reduce(
+          (itemAccumulator: IndexField[], index: IndexFieldDescriptor) => {
+            const alias: IndexAlias = indexesAlias[indexesAliasIdx];
+            const splitName = index.name.split('.');
+            const category = baseCategoryFields.includes(splitName[0]) ? 'base' : splitName[0];
+            return [
+              ...itemAccumulator,
+              {
+                ...(hasDocumentation(alias, index.name) ? getDocumentation(alias, index.name) : {}),
+                ...index,
+                category,
+                indexes: [alias],
+              } as IndexField,
+            ];
+          },
+          []
+        ),
       ],
       []
     )
@@ -84,7 +104,10 @@ export const formatIndexFields = (
           ...accumulator.slice(0, alreadyExistingIndexField),
           {
             ...existingIndexField,
-            indexes: [...existingIndexField.indexes, ...indexfield.indexes],
+            description: isEmpty(existingIndexField.description)
+              ? indexfield.description
+              : existingIndexField.description,
+            indexes: Array.from(new Set([...existingIndexField.indexes, ...indexfield.indexes])),
           },
           ...accumulator.slice(alreadyExistingIndexField + 1),
         ];